Mutually exclusive statements in Cognito docs?

You're correct in identifying a discrepancy between the documentation for the AdminCreateUser API and the Pre Sign-Up Lambda trigger. Based on your testing and the more specific information in the Pre Sign-Up Lambda trigger documentation, it appears that the AdminCreateUser API description is not entirely accurate.

For creating 'system' users or automatically confirmed users through AWS CloudFormation, there are a few approaches you can consider:

1. Use the AdminCreateUser API with "MessageAction" set to "SUPPRESS": This will create the user without sending a welcome message, and the user will be in a "FORCE_CHANGE_PASSWORD" state. You can then use the AdminSetUserPassword API to set a permanent password and confirm the user in one step.

2. Use a Custom Resource in your CloudFormation template: Create a Lambda function that uses the Cognito API to create and confirm the user, then invoke this Lambda through a Custom Resource in your CloudFormation template.

3. Use AWS CDK if possible: AWS CDK provides more flexibility and allows you to use custom resources more easily to perform these operations.

4. Post-deployment scripts: While not ideal, as you mentioned, this is still an option if the above methods are not suitable for your use case.

5. Consider using AWS Identity Center (formerly AWS SSO) for system users if they don't need to be in Cognito specifically.

Remember that automatically confirming users without verification can pose security risks, so ensure this aligns with your security requirements. If you need to create pre-verified system users, you might need to use a combination of the AdminCreateUser API and additional API calls to set the user's status as verified and confirmed.
Sources
Cognito Intermittent Error on Custom Lambda Trigger that redirects to login page solution at ConfirmSignUp. | AWS re:Post
Signing up and confirming user accounts - Amazon Cognito
Amazon Cognito Identity Provider examples using SDK for JavaScript (v3) - AWS SDK Code Examples

You've identified a genuine discrepancy in the AWS documentation regarding the AdminCreateUser API and pre sign-up Lambda triggers. The Pre Sign-Up Lambda documentation is correct - the autoConfirmUser response is ignored when using AdminCreateUser.

For creating pre-confirmed system users with CloudFormation, you have these options:

Option 1: Use MessageAction Parameter (Recommended)

When using AdminCreateUser, set the MessageAction parameter to "SUPPRESS" to create a confirmed user without sending a welcome message:

Resources:
  SystemUser:
    Type: AWS::Cognito::UserPoolUser
    Properties:
      UserPoolId: !Ref UserPool
      Username: systemuser
      DesiredDeliveryMediums:
        - EMAIL
      MessageAction: SUPPRESS
      UserAttributes:
        - Name: email
          Value: system@example.com

This creates a confirmed user that can sign in with the temporary password.

Option 2: Use AdminConfirmSignUp in Custom Resource

Create a custom resource in CloudFormation that calls AdminConfirmSignUp after user creation:

Resources:
  ConfirmUserFunction:
    Type: AWS::Lambda::Function
    # Lambda function that calls AdminConfirmSignUp
  
  ConfirmUserCustomResource:
    Type: Custom::ConfirmUser
    Properties:
      ServiceToken: !GetAtt ConfirmUserFunction.Arn
      UserPoolId: !Ref UserPool
      Username: systemuser

Documentation

• MessageAction Parameter Documentation

I recommend using Option 1 as it's simpler and doesn't require additional Lambda functions.