I currently have AWS cognito User pool setup with email as an option for MFA. I went through setting up SES, registering and verifying the email and finally linking the email with cognito to send codes.

enter image description here

I currently have my user created beforehand and I want to send the MFA code to the users via mail. My app is in FAST API and I am using boto3 cognito client to do everything.

According to what I understand, if we have MFA active and email set up , when the user tries to login I should get the Email_OTP challenge with delivery method as email. This should send the code to users and then the users will provide the code which goes through respond_to_auth_challenge . I am not using the hosted UI and we have our custom login page.

Two things I did not understand.

1. How is cognito going to send the code in case of MFA login ? For new user signup flow , I used admin_create_user where I send the temp password. But here I dont have that option in admin_inititate_auth

2. SES says email was sent, but I did not receive any.

Any help here is appreciated. How can I get this flow to work? The docs aren’t quite clear on this.

Here is part of my code used for login

    cognito = utils.get_cognito_client()
    secret_hash = utils.get_secret_hash(payload.username)
    try:
        response = cognito.admin_initiate_auth(
            AuthFlow="ADMIN_NO_SRP_AUTH",
            UserPoolId=settings.default_cognito_user_pool_id,
            ClientId=settings.default_cognito_client_id,
            ClientMetadata={"IpAddress": payload.ip_address},
            AuthParameters={
                "USERNAME": payload.username,
                "PASSWORD": payload.password,
                "SECRET_HASH": secret_hash,
            },
        )
        if response.get("ChallengeName") == "NEW_PASSWORD_REQUIRED":
            # Return session ID for resetting the password
            return {
                "message": "New password required.",
                "session_id": response["Session"],
            }
        if response.get("ChallengeName") == "EMAIL_OTP":
            # Return session ID for validating code
            return {
                "message": f"One Time Password sent to {payload.username}",
                "session_id": response["Session"]
            }