Troubleshoot Amazon Cognito

Create an A Record for the Parent Domain: You must create an A record in your DNS configuration for the parent domain of your custom domain.

Verify DNS Propagation (Optional but Recommended): To ensure your DNS provider has propagated the change, you can run a dig command.

Remove the parent domain A Record: After successfully creating the custom domain in Amazon Cognito, you can remove the A record you created for the parent domain if it was a dummy one.

To use the domain name for a new user pool, you must delete the custom domain from the user pool it's currently associated with.

Wait after deletion: It takes time for the custom domain to fully delete from the first user pool. Creating a new custom domain with the same name immediately after deletion might still result in this error. Wait a few minutes before trying again.

Option 1: Use a different domain name for your Amazon Cognito custom domain.

Option 2: If you use the domain name for Amazon Cognito, do not use it with another Amazon CloudFront distribution.

Ensure Certificate Region: Confirm the ACM certificate is in the us-east-1 Region.

Check Certificate Validity: Make sure the selected certificate is not expired.

Imported Certificates: If you imported the certificate into ACM, ensure:

AWS KMS Policy Check: An explicit deny statement in an AWS Key Management Service (AWS KMS) policy for the IAM user or role creating the domain can cause this error. Specifically, check for explicit denials on kms:DescribeKey, kms:CreateGrant, or kms:* actions.

Ensure consistent app client ID: When calling the AdminInitiateAuth or InitiateAuth API for token refresh, you must use the exact same app client ID that was used during the initial authentication that generated the refresh token.

Confirm the device: If you have device tracking enabled on your user pool, but the user's device hasn't been confirmed, you must call the ConfirmDevice API first. After the user confirms their device, you can exchange the refresh token.

Include device key in refresh request: If device tracking is enabled, include the unique device key as an AuthParameter when using the REFRESH_TOKEN_AUTH flow:

{
  "AuthFlow": "REFRESH_TOKEN_AUTH",
  "AuthParameters": {
    "REFRESH_TOKEN": "example_refresh_token",
    "SECRET_HASH": "example_secret_hash", // Required if your app client uses a client secret
    "DEVICE_KEY": "example_device_key" 
  }
}

Use USER_SRP_AUTH for device tracking: If you are using device tracking, the initial authentication flow must be USER_SRP_AUTH.

Check the required attributes defined in your user pool configuration.

Using network capture tools in your browser, retrieve the SAML response. You might need to perform URL and base64 decoding. Verify the attribute is present in the SAML assertion.

Sign in to your identity provider and review the attributes that it is sending to Amazon Cognito. Verify that the IdP is configured to send the required attribute using the correct name.

For immutable attributes, run the following AWS CLI command to identify them: aws cognito-idp describe-user-pool --user-pool-id USER-POOL-ID --query 'UserPool.SchemaAttributes[?Mutable==`false`].Name'.

In the SAML attribute mappings of your IdP, delete any mapping that targets an immutable Amazon Cognito attribute. Alternately, update the destination attribute to a different, mutable attribute.

In the management console for your IdP, update the application with the correct ACS URL format, ensuring it uses the HTTP POST binding.

Default domain format: https://cognito-idp.Region.amazonaws.com/your user pool ID/saml2/idpresponse

Custom domain format: https://auth.example.com/saml2/idpresponse

For service provider initiated (SP-initiated) flows: Always start the authentication at your user pool /oauth2/authorize endpoint. SAML assertion that don't return RelayState parameters from the user's initial visit to Amazon Cognito are not valid SP-initiated requests.

For identity provider initiated (IdP-initiated) flows: The IdP must include the RelayState parameter with the SAML assertion to the /saml2/idpresponse endpoint, using the required format: redirect_uri=REDIRECT_URI&state=STATE.

For public applications: Use SetUserMFAPreference with a valid access token to let users set their own MFA preferences

For administrator-managed applications: Use AdminSetUserMFAPreference with AWS credentials to configure user MFA preferences

Check the user's email spam and junk folders.

Confirm that the user exists in the user pool.

Verify that the user's status isn't FORCE_CHANGE_PASSWORD. If this is the case, the user was created by an administrator and Amazon Cognito will prompt them to set a password when they sign in with their temporary password.

Check that the user has a verified email or phone number attribute.

Check your account spend limit for SMS messaging

Check your Amazon Simple Email Service (Amazon SES) message-sending quota.

Check if both SMS and Amazon SES (if your user pool is configured to Send email with Amazon SES) have been moved out of sandbox. If they were not moved out from sandbox, email addresses or phone numbers which have not been verified by Amazon SES or AWS End User Messaging SMS will not be able to receive password reset codes.

If the user has an active MFA factor, check that they aren't trying to generate a message to the same factor. For example, users with email MFA active can't sent password reset codes by email.