Cognito user threat detection not updating after One-Click-Link-Valid is clicked

There appears to be an issue with how the one-click links in the Cognito Advanced Security notification emails are functioning.

When users receive an email notification about potentially suspicious authentication events, they can click on links that correspond to {one-click-link-valid} or {one-click-link-invalid} in your notification template. These links should automatically trigger the UpdateAuthEventFeedback API call to provide feedback on whether the authentication attempt was legitimate.

However, there is a known bug with the "Managed login" experience where the URL uses "clientId" instead of the expected "client_id" parameter, which causes the links to lead to an error page. This prevents the feedback from being properly recorded in the system.

A workaround for this issue is to hardcode the user pool client ID directly in your notification template using: {one-click-link-valid}&client_id=my-actual-client-id.

Regarding your specific questions:

1. Yes, the one-click links should automatically trigger the UpdateAuthEventFeedback call on AWS's end when clicked, but the bug may be preventing this.

2. It's not your responsibility to call UpdateAuthEventFeedback manually in a Lambda - this should happen automatically when users click the links in the email.

3. You can verify if feedback was recorded by checking the user's event history in the Amazon Cognito console. Navigate to your user pool, search for the user, select their username, and check the "User event history" section. This will show risk levels and actions taken.

4. The user might still be blocked because the feedback wasn't properly recorded due to the parameter name issue in the links. Even when a user marks an event as valid, Amazon Cognito needs to successfully process this feedback to update the risk evaluation for that user.

Since this appears to be a bug with the Cognito service, you may want to report it via a Support ticket in the AWS Console for your account.
Sources
Bug report: Cognito Advanced Security user notification has wrong parameter name in links | AWS re:Post
UpdateAuthEventFeedback - Amazon Cognito User Pools
Working with adaptive authentication - Amazon Cognito
Adding threat detection to custom authentication flow with Amazon Cognito advanced security features | AWS Security Blog

Hello,

Warm Greetings from AWS Premium Support. I hope you're doing well.

Thank you for reaching out to us with your concern.

Upon reviewing your correspondence, I understand that you have query related to threat detection not updating after One-Click-Link-Valid is clicked, Please feel free to correct me in case I misunderstood your concern.

• The one-click links in the email do NOT automatically trigger the UpdateAuthEventFeedback API call

• These links are designed to direct users to your application, where you need to handle the feedback submission

As I see that this issue need live troubleshooting and investigation, I would request you to raise a Support case directly to Technical team for further assistance on the issue as this re-post is public to all.

Looking at the UpdateAuthEventFeedback documentation it says:

Users invoke this operation when they select the link that corresponds to {one-click-link-valid} or {one-click-link-invalid} in your notification template.

So according to the documentation it should? I'm not sure there is a manual way of doing it, I will raise the issue with the Technical team thank you.