AWS Cognito: No option to stop mobile number update until verified

[Harshroc]

Description

I have select user verification through email. So, in sign up experience, want to keep Keep original attribute value active when an update is pending for Mobile number, but this option is disabled.

While signup user is entering his email and mobile number both, but we want user to confirm through email.

Affected Resource(s) and/or Data Source(s)

No response

Potential Terraform Configuration

No response

References

No response

Would you like to implement a fix?

None

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[trevorrea]

You need to give more detail of what you're talking about as it's not clear at all but as far as I can see what you are asking for is already available at https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_user_pool#user_attribute_update_settings

user_attribute_update_settings
attributes_require_verification_before_update - (Required) A list of attributes requiring verification before update. If set, the provided value(s) must also be set in auto_verified_attributes. Valid values: email, phone_number.

[Harshroc]

We want to signup users with email and we have kept SMS_MFA optional. So, to confirm the user we verify email. 

Now when the user wants to enable MFA. So, the user updates his phone number (updateUserAttributes) and then we send the verification code (getUserAttributeVerificationCode). But if the user does not verify his phone number then also the phone number gets updated in the Cognito. 

But this does not happen in the case of email, until the user does not verify his email, it does not changes as we have enabled - Keep original attribute value active when an update is pending - Recommended.

In the given options, only email is enabled and the phone is disabled.

[trevorrea]

This sounds like something you need to raise an AWS support ticket for rather than an AWS provider bug but you need to provide the Terraform code you are using.