aws cognito-idp set-user-pool-mfa-config

Sets user pool multi-factor authentication (MFA) and passkey configuration. AWS CLI reference

1 example 6 options Its page in the AWS CLI reference

Examples

from aws-cli, each command read by CmdID

To configure user pool MFA and WebAuthn

The following set-user-pool-mfa-config example configures the requested user pool with optional MFA with all available MFA methods, and sets the WebAuthn configuration.

aws cognito-idp set-user-pool-mfa-config --user-pool-id us-west-2_EXAMPLE --sms-mfa-configuration "SmsAuthenticationMessage=\"Your OTP for MFA or sign-in: use {####}.\",SmsConfiguration={SnsCallerArn=arn:aws:iam::123456789012:role/service-role/test-SMS-Role,ExternalId=a1b2c3d4-5678-90ab-cdef-EXAMPLE11111,SnsRegion=us-west-2}" --software-token-mfa-configuration Enabled=true --email-mfa-configuration "Message=\"Your OTP for MFA or sign-in: use {####}\",Subject=\"OTP test\"" --mfa-configuration OPTIONAL --web-authn-configuration RelyingPartyId=auth.example.com,UserVerification=preferred

Identify

--user-pool-idThe user pool ID.

--sms-mfa-configurationConfigures user pool SMS messages for MFA.

--software-token-mfa-configurationConfigures a user pool for time-based one-time password (TOTP) MFA.

--email-mfa-configurationSets configuration for user pool email message MFA and sign-in with one-time passwords (OTPs).

--mfa-configurationSets multi-factor authentication (MFA) to be on, off, or optional.

--web-authn-configurationThe configuration of your user pool for passkey, or WebAuthn, authentication and registration.

Its output

{
    "EmailMfaConfiguration": {
        "Message": "Your OTP for MFA or sign-in: use {####}",
        "Subject": "OTP test"
    },
    "MfaConfiguration": "OPTIONAL",
    "SmsMfaConfiguration": {
        "SmsAuthenticationMessage": "Your OTP for MFA or sign-in: use {####}.",
        "SmsConfiguration": {
            "ExternalId": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
            "SnsCallerArn": "arn:aws:iam::123456789012:role/service-role/test-SMS-Role",
            "SnsRegion": "us-west-2"
        }
    },
    "SoftwareTokenMfaConfiguration": {
        "Enabled": true
    },
    "WebAuthnConfiguration": {
        "RelyingPartyId": "auth.example.com",
        "UserVerification": "preferred"
    }
}

For more information, see Adding MFA and Passkey sign-in in the Amazon Cognito Developer Guide.

Options

6 in the AWS CLI reference