How do I resolve email and SMS MFA delivery failures in Amazon Cognito?

Resolution

Note: To troubleshoot MFA configuration errors from your user pool, see How do I troubleshoot MFA error messages in my Amazon Cognito user pool?

Verify Amazon Cognito user pool and MFA settings

To verify that your user pool has the correct settings, complete the following steps:

1. Open the Amazon Cognito console.
2. Check that your user exists in the Amazon Cognito user pool.
3. Verify that the user has a Confirmed status.
   Note: If the user status shows External provider, then the external Identity Provider (IdP) authenticates the user. Amazon Cognito doesn't manage MFA settings for these users. If your IdP manages MFA, then manage your MFA configuration through your IdP.
4. Confirm that you configured your user pool for MFA enforcement to Required MFA - Recommended or Optional MFA.
   Note: If you configure your user pool with Optional MFA, then the MFA prompt during the login depends on individual user settings. Configure these settings either through the Amazon Cognito console, or build your own interface to prompt your users to set up MFA.
5. Check your user's MFA configuration settings, and verify that each user has the correct and preferred MFA method configured.
6. Verify that you configured different methods for AWS Account recovery and MFA delivery.

Check SMS delivery configuration

Take the following actions:

• Confirm that your service-linked AWS Identity and Access Management (IAM) role has the sns:Publish permission and the correct trust policy.
• Check that service control policies (SCPs) don't block the sns:Publish action.
• Check if your account exceeded the default account spend threshold for SMS. If your account exceeded the quota, then your users don't receive SMS MFA codes. To increase the quota, submit an Amazon Simple Notification Service (Amazon SNS) quota increase request.
• For sandbox environments, confirm that your users verified their phone numbers. For more information, see Using the Amazon SNS SMS sandbox.
• For US phone numbers, verify that you have an origination identity to send SMS text messages to US phone numbers. If you don't have an origination identity, then request a phone number in AWS End User Messaging SMS.

Check email delivery setup

Take the following actions:

• Ask your users to check their spam or junk folders for the MFA email.
• Verify that your account hasn't exceeded the Amazon Simple Email Service (Amazon SES) sending quota.
• For sandbox environments, confirm that your users verified their destination email addresses.
• Verify that the recipient's email address isn't on the Amazon SES suppression list.

Check Amazon Cognito logs

If you turned on advanced security with threat protection, then check the exported logs from your user pool for information about delivery failures. For more information, see Exporting email and SMS message delivery errors.

Related information

Moving out of the Amazon SNS SMS sandbox

Request production access (Moving out of the Amazon SES sandbox)