We have a basic JavaScript web application working with Cognito through OIDC. It works great. Users can sign up and their accounts are in Cognito. It can send a confirmation email to users. It handles password resets very easily by sending a recovery link to users.

But the one thing it can’t do is allow users to change their own passwords. Let’s say a user decides it’s time for a new password and wants to change it. There doesn’t seem to be any Cognito web interface for this. I realize I can add some JavaScript that will do user.setPassword(newpassword). But then I have to write my own UI for that, and even worse, this will bypass all the Cognito password strength requirements, or alternatively, I have to build in a UI to enforce those requirements. The whole point of Cognito was so that I wouldn’t have to be in the password business anymore, and yet it seems like it’s forcing me to deal with passwords…

I realize one other option is to federate in another IdP and let that IdP handle password changes. For example, Google users can log in to Google and change their passwords. But if I’m doing that, I would just skip Cognito entirely and use Google as my OIDC provider. (More realistically I would use a dedicated OIDC provider like Okta.)

Any suggestions on how to do this? I’m stunned that AWS somehow “forgot” to allow users to change their passwords, or else is forcing developers to get back into the password business, which is the cause of tremendous problems.