AdminGetUser only works with User Username, not Sub

Question

I exec this command:
```
aws cognito-idp admin-get-user --user-pool-id "us-west-2_dkEwXXXXX" --username "ae163f5c-15f5-4496-XXXX-1703d45XXXXX" --profile devops
```
and I get 
```
An error occurred (UserNotFoundException) when calling the AdminGetUser operation: User does not exist.
```

The documentation states: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html
The username of the user that you want to query or modify. The value of this parameter is typically your user's username, but it can be any of their alias attributes. **If username isn't an alias attribute in your user pool, this value must be the sub of a local user** or the username of a user from a third-party IdP.

THIS DOESN'T WORK!

Here is a screen shot of the user.
![Cognito User Page](/media/postImages/original/IMAFJBJFapQ-qm0bBKajg6Eg)

Answer

Looking at your screenshot, you have email mapped to user name, so that value needs to be passed in as `username`

```
aws cognito-idp admin-get-user --user-pool-id us-west-2_dkEwXXXXX --username testuser@sty-holdings.com
```

If you want to query by `sub`, use [ListUsers](https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_ListUsers.html) and filter. Here is an AWS CLI example for [list-users](https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/list-users.html)

```
aws cognito-idp list-users --user-pool-id us-west-2_dkEwXXXXX --filter "sub = \"ae163f5c-15f5-4496-XXXX-1703d45XXXXX\"" 
```

Answer

To make sure I understand, are you saying the documentation is wrong?
"If username isn't an alias attribute in your user pool, **this value must be the sub** of a local user or the username of a user from a third-party IdP."
So admin-get-user does not work with sub?

AdminGetUser only works with User Username, not Sub

Relevanter Inhalt