Cognito User Migration Lambda not working ( NotAuthorizedException )

I have a cognito user pool with application configured. Logging in with users that i've manually created is working fine.

Now I want to seamlessly migrate users from the existing system to Cognito, so I'm trying to use an Lambda function that validates username/password to the existing database.

In my logging I see that the function is being called when I try to log in, and it returns a valid result. But still cognito is returning

An error occurred (NotAuthorizedException) when calling the InitiateAuth operation: Incorrect username or password.

The response I see from my lambda is

{
    "triggerSource": "UserMigration_Authentication",
    "userName": "my@email.ext",
    "request": {
        "password": "SomeSecurePasswordEnteredOnLogin"
    },
    "response": {
        "userAttributes": {
            "email": "my@email.ext",
            "email_verified": true
        },
        "finalUserStatus": "CONFIRMED",
        "messageAction": "SUPPRESS",
        "desiredDeliveryMediums": [
            "EMAIL"
        ],
        "forceAliasCreation": false,
        "enableSMSMFA": false
    }
}

I've also tried returning an username field in "userAttributes" with the email value. But i'm not getting anything working. Also tried to only return the "response" part of the json.

I've read https://repost.aws/knowledge-center/cognito-migration-lambda-trigger-errors but none of the errors there match the incorrect username or password I'm getting.

To try and login I use

aws cognito-idp initiate-auth --client-id <your-client-id> --auth-flow USER_PASSWORD_AUTH --auth-parameters "USERNAME=<username>,PASSWORD=<password>"

For an existing user this works fine, for a new user I see the call to my lambda that returns a result that I think is ok, but still the incorrect username or password error. Any idea what I'm doing wrong?