AWS Cognito fails to resetPassword() for verified email

Question

I'm having an issue with Cognito from AWS. After creating new identity and user pools for, and registering them for MFA (email), I cannot use the "resetPassword" functionality. It does not work even from the console, when I click onto the user and try to manually reset their password from the AWS GUI, I get this error message:

```
Cannot reset password for the user as there is no registered/verified email or phone_number
```

However, I've checked multiple times and the email is verified, I see this displayed in the console:

![verified](/media/postImages/original/IMMNZ6M7tHS0OgeE4MFEKU6g)

I also see `email_verified: true` when I query AWS directly with `aws cognito-idp`. I've also gone through the `signIn` process with this account, and encountered no errors. I can also receive MFA confirmation codes and they work. `resetPassword` is the one thing that does not seem to work.

However, no matter what I do I keep getting an error that there is no "registered/verified email or phone_number". `phone_number` isn't required anywhere in my user or identity pool.

For what it's worth, we use Amazon SES for delivering the MFA codes, and it's how I'd expect to receive an email containing "reset password" instructions.

Any help would be appreciated, thanks.

re:Post Agent · Answer

The issue you're experiencing with Cognito's password reset functionality is unexpected and inconsistent with its standard behavior. Typically, if a user has a verified email address, they should be able to reset their password without any problems, even if they don't have a phone number associated with their account.

Here are a few things to check and try:

1. Verify that the account recovery settings in your user pool are correctly configured. Make sure that email is included as a recovery mechanism and that it's set to "Email only" or includes email as an option.

2. Double-check that the user's email is actually marked as verified in the Cognito user pool. Sometimes there can be a discrepancy between what appears to be verified and the actual status in the system.

3. Ensure that your SES email configuration is correctly set up and linked to your Cognito user pool. Test sending a test email through SES to confirm that email sending is functioning correctly.

4. Check if the issue is specific to one user or affects all users in the pool. Try initiating the password reset process for a different user to see if the problem is user-specific or affects the entire pool.

5. Review your user pool's account recovery settings to ensure email is prioritized for password recovery.

If the problem persists after these checks, it could potentially be due to a recent change or bug in the Cognito service. In this case, it would be advisable to contact AWS Support for further assistance, as this behavior is inconsistent with Cognito's documented functionality. They may be able to investigate if there's an underlying issue with the service or your specific configuration that's causing this unexpected error.

Remember, forcing users to provide a phone number should not be necessary if they have a verified email address, based on Cognito's standard functionality. The situation you're describing appears to be anomalous and may require further investigation by AWS.  
**Sources**  
[Cognito forget password through AWS Console error | AWS re:Post](https://repost.aws/questions/QUOecn0HYjSyqYoMWLOCU1RQ/cognito-forget-password-through-aws-console-error)  
[Cognito - unable to reset password with no phone number added | AWS re:Post](https://repost.aws/questions/QUaB0tZ4jzTbGyZzZ4s6Z6Uw/cognito-unable-to-reset-password-with-no-phone-number-added)  
[Passwords, account recovery, and password policies - Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/managing-users-passwords.html)

AWS Cognito fails to resetPassword() for verified email

Relevant content