Custom password reset flow

You can implement a self-service password reset flow with custom verification steps using Amazon Cognito's custom authentication flows, but there are some important considerations.

Custom authentication flows in Cognito are designed to extend the authentication process with additional challenges beyond the standard methods. These flows use Lambda triggers to define, create, and verify challenges. If you want to include your own OTP solution and app-specific verifications, you can implement this through the custom authentication flow.

For password resets specifically, you would need to:

1. Start with the CUSTOM_AUTH flow by calling InitiateAuth
2. If you want to include SRP (Secure Remote Password) in your custom flow, you must begin with SRP
3. Use Lambda triggers to define your custom challenges (like your OTP and additional verifications)
4. After successful verification, use the AdminResetUserPassword API to reset the user's password

Keep in mind that when AdminResetUserPassword is called, it sets the user's account status to RESET_REQUIRED and the user will need to set a new password at their next sign-in attempt.

One important limitation to be aware of: if you're using MFA in your user pool, users need to have both email and phone number attributes set for self-service password recovery. This is because users can't receive MFA and password reset codes at the same email address or phone number. If they use email for MFA, they must use SMS for account recovery, and vice versa.

If you're implementing your own OTP solution rather than using Cognito's built-in functionality, you'll need to handle the generation, delivery, and verification of these codes in your application logic and Lambda functions.
Sources
Custom authentication challenge Lambda triggers - Amazon Cognito
Passwords, account recovery, and password policies - Amazon Cognito
Authentication flows - Amazon Cognito
AdminResetUserPassword - Amazon Cognito User Pools

If "perform additional verifications which are specific to my app" can be fit into an AWS lambda function, you can use Custom Auth flow to implement this verification, however, the final result of custom auth flow is to grant the end user his jwt token. I didn't see too much value on doing so for a resetting password flow. Instead, you can have an own backend service to verify the OTP and 'additional verification' then call adminSetUserPassword with "Permanent" to true for the new password in case the answers are valid.