Cognito CustomMessage Lambda Not Triggering with “Don’t Automatically Send Messages” Enabled

The issue you're experiencing is due to a fundamental misunderstanding of how the Custom Message Lambda trigger works in relation to the "Don't automatically send messages" setting.

When you select "Don't automatically send messages" in your user pool settings, Amazon Cognito completely bypasses the message sending process, including any CustomMessage Lambda triggers. This setting is designed for scenarios where you want to handle all communication through other means, such as the CustomEmailSender or CustomSMSSender Lambda triggers, or through your own application logic entirely.

The CustomMessage Lambda trigger is specifically designed to modify the content of messages that Cognito will send - it doesn't replace the sending mechanism itself. This trigger receives the contents of email and SMS messages before they're sent, allowing you to modify the message contents and subject, but Cognito still handles the actual delivery.

For your use case, you have two options:

1. Enable "Cognito sends messages" and configure a CustomMessage Lambda trigger. This will allow you to customize the message content, but Cognito will still handle delivery through its default channels (Amazon SES for email).

2. Use the CustomEmailSender and/or CustomSMSSender Lambda triggers instead. These triggers are specifically designed to support third-party email and SMS providers like Mailgun. With these triggers, Amazon Cognito will send the verification codes and other sensitive information to your Lambda functions (encrypted with AWS KMS), and your functions will be responsible for delivering the messages through your preferred provider.

The CustomEmailSender and CustomSMSSender triggers are the appropriate choice if you want to use Mailgun for delivery while still leveraging Cognito's user management features. Note that these configurations cannot be done through the Amazon Cognito console and must be set up using the AWS CLI or SDK.
Sources
Custom message Lambda trigger - Amazon Cognito
Configuring email or phone verification - Amazon Cognito
Custom sender Lambda triggers - Amazon Cognito

Question 1: Is CustomMessage trigger skipped when "Don't automatically send messages" is enabled?

Yes, the CustomMessage trigger is completely skipped when "Don't automatically send messages" is enabled. This setting bypasses the entire message delivery flow, including Lambda triggers.

Question 2: What is the proper configuration to intercept messages?

The proper configuration is:

1. Enable "Cognito sends messages" in your user pool settings
2. Configure your CustomMessage Lambda trigger
3. In your Lambda, send messages via Mailgun
4. Return the event with empty message content to prevent Cognito's default delivery

Question 3: Can you safely enable "Cognito sends messages" only to invoke Lambda?

Yes, you can safely enable "Cognito sends messages" to invoke your Lambda while preventing Cognito's default delivery by:

1. Processing the event in your Lambda
2. Sending the message through Mailgun
3. Returning the event with empty message content:

exports.handler = async (event) => {
  // Send via Mailgun using event data
  await sendViaMailgun(event);
  
  // Prevent Cognito's default delivery
  event.response.emailMessage = "";
  event.response.emailSubject = "Your Subject"; // Required but won't be used
  
  return event;
};

This approach triggers your Lambda but prevents Cognito from sending duplicate messages, giving you full control over message delivery through Mailgun.