AWS Cognito - PostSignUp Trigger Not Working

Question

i have a post signup trigger setup to store the user details in DynamoDb table. This works fine when the user signs up on their own through the front-end but the trigger is never invoked if the user is created through AdminCreateUser API. Our assumption was after the newly added user gets an email with a temporary password and logins through the front-end, Cognito will invoke the postsignup trigger.

Is that an expected behavior? And also, how do we address this issue?

Suk

Answer 1

Although that's counter intuitive, seems that's the expected behavior.

Post Confirmation trigger is not invoked when a user is created via AdminCreateUser API.

Workaround could be to to use Post Authentication trigger and during processing of the fired event to check if cognito:user_status is FORCE_CHANGE_PASSWORD.

When a user is created using AdminCreateUser, status of the new user is set to FORCE_CHANGE_PASSWORD. Once user logs in and changes temporary password, status is changed to CONFIRMED.

Downside is that trigger is invoked after every login.

Manganate

This is what I ended up doing. Thanks for your response, AWS should address this issue. – Suk

@Emon: AWS already knows about this since 2017: forums.aws.amazon.com/thread.jspa?messageID=775800. Unfortunately they didn't resolve this issue still – Tussore

For the record, I just ran into this issue. It's 2023. I'll now work on implementing the Post Authentication workaround as suggested above. – Circumspection

Downside is that trigger is invoked after every login. So, that sounds like a terrible tradeoff! – Goudy

AWS needs to fix this. – Overwhelm

Answer 2

It really sucks but performing a regular SignUp command instead of AdminCreateUser on the server side is probably the least bad option...

Profiterole