Pre-Signup Set Immutable UUID

Question

I am trying to create a UUID for a Cognito user upon signup but also want to make it immutable. Currently I am using the AWS Pre-signup trigger but because UUID is immutable and called after the Cognito user is created, it is giving the error `"errorType":"InvalidParameterException","errorMessage":"user.custom:uuid: Attribute cannot be updated." `Do I have to make UUID mutable or is there another workaround?

```
import { uuidv7 } from 'uuidv7';
import {
   AdminUpdateUserAttributesCommand,
   CognitoIdentityProviderClient
 } from "@aws-sdk/client-cognito-identity-provider";
 
 export const handler = async (event, context, callback) => {
   console.log(event);
   const client = new CognitoIdentityProviderClient({});
   let uuid = uuidv7();
   console.log(uuid);
   console.log(uuid.length);
   await client.send(new AdminUpdateUserAttributesCommand({
      UserAttributes: [
          {
              Name: 'custom:uuid',
              Value: uuid
          }
      ],
      UserPoolId: 'userpoolid',
      Username: event.request.userAttributes['username']
  }))
   
   callback(null, event);
 };
```

I can make the UUID mutable, but I would prefer not to do that. The reason I am making a UUID instead of using `sub` is because in case I want to transfer users to another pool at a later date and use some id as the primary key in my database, I can use UUID.

re:Post Agent · Answer

The issue you're encountering is due to the timing of when you're trying to set the immutable UUID attribute. The pre-signup Lambda trigger is indeed executed before the user is fully created in the Cognito user pool, but it's not the right place to set immutable attributes.

Instead of using the pre-signup trigger, you have a couple of options to set an immutable UUID for your Cognito users:

1. Use the sign-up API directly: When you call the SignUp API, you can include the immutable custom:uuid attribute as part of the user attributes. This way, the UUID is set during user creation and doesn't need to be updated later.

2. Use the AdminCreateUser API: If you're creating users programmatically (not through self-signup), you can use the AdminCreateUser API and include the immutable custom:uuid attribute in the initial user creation.

3. Use a post-confirmation Lambda trigger: If you need to generate the UUID after the user is created but before they can use the account, you can use a post-confirmation Lambda trigger. This trigger is executed after the user is confirmed, allowing you to set the immutable attribute at that point.

If you decide to use the post-confirmation trigger approach, your Lambda function would look similar to your current code, but it would be triggered at a different point in the user creation process.

Regarding your concern about potentially transferring users to another pool later, using a custom UUID is a good approach. It provides you with a consistent identifier that you control, which can be useful for database primary keys and user migration scenarios.

Remember that whichever method you choose, you'll only be able to set the immutable custom:uuid attribute once during the user creation process. After that, it cannot be changed.  
**Sources**  
[Working with user attributes - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html)  
[Pre sign-up Lambda trigger - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.html)

TheQuietBuilder · Answer

You're running into this issue because custom:uuid is marked as immutable, and you're trying to set it in the Pre-Signup trigger, which doesn't let you modify attributes during that phase.

Here's how to work around it:
Option 1: Pass the UUID during signup
If you're using the SignUp API (client-side), just include custom:uuid in the UserAttributes when calling it. That way, it's set before the user is created.

Option 2: Use AdminCreateUser (server-side)
If you're creating users via backend services, you can include custom:uuid right at the time of creation using this API.

Option 3: If you're sticking with Lambda, switch to PostConfirmation
This only works if you're okay making custom:uuid mutable, because once the user is created, Cognito won't let you set an immutable attribute unless it was already part of the creation.

Since you're planning for long-term portability between user pools, having your own UUID is a smart call — just make sure it gets assigned at the start.

Pre-Signup Set Immutable UUID

Add your answer

Relevant content