Cognito User pool migration to another AWS account (with SSO)

Key Considerations for Migration:

Passwords and MFA Tokens:

Cognito does not allow you to export or import passwords or MFA tokens due to security reasons. This means that users will have to reset their passwords when they are migrated to the new user pool. MFA setup will also have to be reconfigured​ (Cloudar)​ (DEV Community). SSO Users:

If your Cognito user pool integrates with an external SSO provider, those users are authenticated through the SSO provider and not by Cognito itself. When you migrate these users to a new pool and configure the same SSO provider, they should be able to log in without needing to reset their passwords. This is because the authentication happens outside of Cognito​ (Cloudar).

Migration Approaches:

Bulk User Import: You can export users from the old pool and import them into the new one. However, this will require users to reset their passwords, unless they are SSO users.

User Migration Lambda Trigger: Another approach is to use a migration Lambda trigger that imports users into the new pool upon their first sign-in. This allows for a smoother transition, but you'll need to keep the old pool active until all users have migrated​ (DEV Community).

Recommended Steps:

Set Up SSO in the New Cognito Pool:

Configure the same SSO provider in the new Cognito pool to ensure that users authenticated through SSO can continue to log in without disruption.

Communicate with Users:

If you have users who do not use SSO, prepare them for a password reset as part of the migration.

Testing:

Before fully migrating, test the new setup with a small group of users to ensure everything works smoothly.