# LambdaConfigProperty

A collection of user pool Lambda triggers.

Amazon Cognito invokes triggers at several possible stages of user pool operations. Triggers can modify the outcome of the operations that invoked them.

- Source: Generated code
- Type last changed: v2.239.0 · 19 Feb 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_cognito as cognito } from 'aws-cdk-lib';
const lambdaConfigProperty: cognito.CfnUserPool.LambdaConfigProperty = {
  createAuthChallenge: 'createAuthChallenge',
  customEmailSender: {
    lambdaArn: 'lambdaArn',
    lambdaVersion: 'lambdaVersion',
  },
  customMessage: 'customMessage',
  customSmsSender: {
    lambdaArn: 'lambdaArn',
    lambdaVersion: 'lambdaVersion',
  },
  defineAuthChallenge: 'defineAuthChallenge',
  inboundFederation: {
    lambdaArn: 'lambdaArn',
    lambdaVersion: 'lambdaVersion',
  },
  kmsKeyId: 'kmsKeyId',
  postAuthentication: 'postAuthentication',
  postConfirmation: 'postConfirmation',
  preAuthentication: 'preAuthentication',
  preSignUp: 'preSignUp',
  preTokenGeneration: 'preTokenGeneration',
  preTokenGenerationConfig: {
    lambdaArn: 'lambdaArn',
    lambdaVersion: 'lambdaVersion',
  },
  userMigration: 'userMigration',
  verifyAuthChallengeResponse: 'verifyAuthChallengeResponse',
};
```

## Properties

- `createAuthChallenge`: string — The configuration of a create auth challenge Lambda trigger, one of three triggers in the sequence of the [custom authentication challenge triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-challenge.html) .

- `customEmailSender`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnUserPool.CustomEmailSenderProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.CfnUserPool.CustomEmailSenderProperty.html) — The configuration of a custom email sender Lambda trigger.

  This trigger routes all email notifications from a user pool to a Lambda function that delivers the message using custom logic.

- `customMessage`: string — A custom message Lambda trigger.

  This trigger is an opportunity to customize all SMS and email messages from your user pool. When a custom message trigger is active, your user pool routes all messages to a Lambda function that returns a runtime-customized message subject and body for your user pool to deliver to a user.

- `customSmsSender`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnUserPool.CustomSMSSenderProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.CfnUserPool.CustomSMSSenderProperty.html) — The configuration of a custom SMS sender Lambda trigger.

  This trigger routes all SMS notifications from a user pool to a Lambda function that delivers the message using custom logic.

- `defineAuthChallenge`: string — The configuration of a define auth challenge Lambda trigger, one of three triggers in the sequence of the [custom authentication challenge triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-challenge.html) .

- `inboundFederation`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnUserPool.InboundFederationProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.CfnUserPool.InboundFederationProperty.html)

- `kmsKeyId`: string — The ARN of an [KMS key](https://docs.aws.amazon.com//kms/latest/developerguide/concepts.html#master_keys) . Amazon Cognito uses the key to encrypt codes and temporary passwords sent to custom sender Lambda triggers.

- `postAuthentication`: string — The configuration of a [post authentication Lambda trigger](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-post-authentication.html) in a user pool. This trigger can take custom actions after a user signs in.

- `postConfirmation`: string — The configuration of a [post confirmation Lambda trigger](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-post-confirmation.html) in a user pool. This trigger can take custom actions after a user confirms their user account and their email address or phone number.

- `preAuthentication`: string — The configuration of a [pre authentication trigger](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-authentication.html) in a user pool. This trigger can evaluate and modify user sign-in events.

- `preSignUp`: string — The configuration of a [pre sign-up Lambda trigger](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-sign-up.html) in a user pool. This trigger evaluates new users and can bypass confirmation, [link a federated user profile](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-identity-federation-consolidate-users.html) , or block sign-up requests.

- `preTokenGeneration`: string — The legacy configuration of a [pre token generation Lambda trigger](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html) in a user pool.

  Set this parameter for legacy purposes. If you also set an ARN in `PreTokenGenerationConfig` , its value must be identical to `PreTokenGeneration` . For new instances of pre token generation triggers, set the `LambdaArn` of `PreTokenGenerationConfig` .

- `preTokenGenerationConfig`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnUserPool.PreTokenGenerationConfigProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_cognito.CfnUserPool.PreTokenGenerationConfigProperty.html) — The detailed configuration of a [pre token generation Lambda trigger](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html) in a user pool. If you also set an ARN in `PreTokenGeneration` , its value must be identical to `PreTokenGenerationConfig` .

- `userMigration`: string — The configuration of a [migrate user Lambda trigger](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-migrate-user.html) in a user pool. This trigger can create user profiles when users sign in or attempt to reset their password with credentials that don't exist yet.

- `verifyAuthChallengeResponse`: string — The configuration of a verify auth challenge Lambda trigger, one of three triggers in the sequence of the [custom authentication challenge triggers](https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-challenge.html) .