Forgot Password flow issue with Email and TOTP as MFA

This issue appears to be related to how Amazon Cognito handles password recovery when MFA is configured with both Email and TOTP options.

When a user has Email MFA enabled, Cognito cannot use the same email address for password recovery. This is by design - users can't receive MFA and password reset codes at the same email address or phone number. If they use one-time passwords (OTPs) from email messages for MFA, they must use SMS messages for account recovery.

In your case, when users have configured TOTP as their MFA method, the password recovery works correctly because Cognito can send the recovery code to their email. However, when users are using Email as their MFA method, Cognito cannot send the recovery code to the same email address, resulting in the error you're seeing.

To resolve this issue, you have a few options:

1. Ensure users have both email and phone number attributes set. When users have both attributes, Amazon Cognito automatically sends password-reset codes to the destination that is not the user's MFA factor.

2. Make both email and phone_number attributes required in your user pool configuration to prevent this situation.

3. Consider disabling Email MFA and only using TOTP (authenticator app) as your MFA option if you want to use email for password recovery consistently.

4. Set up processes that always collect and set both email and phone number attributes when users sign up or when administrators create user profiles.

This behavior is not a bug but rather a security design in Cognito to ensure that account recovery and MFA use separate channels for verification.
Sources
Passwords, account recovery, and password policies - Amazon Cognito
Cognito - unable to reset password with no phone number added | AWS re:Post
Email MFA is only way for all users after enable Email MFA | AWS re:Post
Cognito forget password through AWS Console error | AWS re:Post