How to reduce the number of OTP sent for authentication when user has expired password

AWS Cognito sends 2 OTP whenever password expired

Currently authentication workflow uses Lambda triggers and MFA is set optional.

Pre authentication Lambda Trigger

Attached : lambda-expirationPasswordTimeChecker

The provided script is designed to enforce custom password expiration logic for users when password has 3 month old and perform reset password.

Here's an explanation of its use case and purpose:

Custom Password Expiration Policy:

While Cognito handles "Forgot Password" functionality, it doesn’t natively enforce password expiration for permanent passwords.

This script ensures that if a user's password is older than the defined expiration policy (e.g., 90 days), the system resets their password programmatically.

Security Compliance:

Some organizations or tenants might have regulatory or internal compliance requirements mandating periodic password updates (e.g., every 90 days).

The script enables this functionality by leveraging Cognito and maintaining expiration data as a custom attribute in Cognito (custom:expirationDatetime).

Audit and Tenant-Specific Logic:

The script retrieves tenant-specific and user-specific information from DynamoDB tables (TENANT_POOLS_TABLE_NAME and USERS_TABLE_NAME).

These data are logged for audit purposes, ensuring administrators can monitor which user's password was reset and which tenant they belong to

Pre token generation Lambda Trigger & Post Confirmation Lambda trigger

Attached : lambda-expirationPasswordTimeUpdater

Similar to above, the provided script is designed to enforce custom password expiration logic for users when change password.

Set the EXPIRATION_PASSWORD_MONTHS = 3

Key Differences

1. PreAuthentication Lambda Trigger (Cognito) Purpose: Runs custom logic as part of the authentication flow in AWS Cognito.

When It Runs:

Executed after Cognito verifies a user's credentials but before it issues tokens (ID, access, or refresh tokens).

Allows you to perform checks (e.g., enforce password expiration policies, account state validation) or log events (like successful logins).

Use Cases:

Enforcing business logic like password expiration, account suspension, etc.

Enhancing security by validating or altering login attempts.

Tracking user-specific attributes or events in an external system (like DynamoDB, for audit purposes).

2. Lambda Authorizer (API Gateway) Purpose: Verifies and validates API requests before granting access to specific resources.

When It Runs:

Executed by API Gateway after receiving an API request and before invoking the target service or Lambda function.

Usually checks a Cognito-issued token (ID or access token) in the API request header to validate a user's access to the API.

Use Cases:

Validating JWT tokens and confirming claims (e.g., roles or permissions).

Enforcing additional resource-level access controls (e.g., tenant isolation or access limits).

Retrieving and attaching user context (e.g., permissions, tenant info) for the backend to consume.Temporary vs. Permanent Passwords:

Temporary passwords created via AdminCreateUser or similar functions have a 90-day expiration.

A new password set through "Forgot Password" is permanent and does not have an expiration timeline unless enforced by a custom policy.