Cognito `postAuthentication` lambda never gets triggered after AdminLinkProviderForUser

I discovered some relevant information on Stack Overflow that may explain why the Cognito postAuthentication Lambda trigger is not being invoked after calling AdminLinkProviderForUser.

https://stackoverflow.com/questions/68859052/aws-cognito-email-unverified-on-main-account-after-adminlinkproviderforuser

If the user logs in with a connected provider account, it appears that the Lambda triggers for pre/post-authentication and post-confirmation do not fire. Furthermore, if you try to manually change the provider's user inside Cognito, you may still run into problems, such as the email verified attribute being set to false.

Some alternative solutions are:

Some providers supported by Cognito, such as Google, have an 'email verified' attribute that you can directly map in the Attribute Mapping section. By doing this, you can solve the issue for those specific providers.

For providers that don't natively have the 'email verified' attribute, such as Facebook, you can enforce its verification through the pre-token trigger. In the Lambda function invoked by this trigger, you can check if the user getting authenticated has a provider linked to it and, at the same time, has its email_verified attribute set to false. If these conditions are met, you can update the user using the adminUpdateUserAttributes method before returning to Cognito. This ensures that the email_verified attribute is always set to true, regardless of any subsequent provider login that might flip the attribute back to false​.