Cognito User Pool migration with Migrate User Lambda Trigger failing without cause.

Question

I created a new Cognito user pool and set up a Migrate user Lambda trigger that has an execution role with the necessary IAM permissions (cognito-idp:AdminCreateUser, cognito-idp:AdminSetUserPassword, etc) and successfully runs without timing out. It returns the following example JSON Response Structured event upon running (as logged via CloudWatch): 
```
{
  version: '1',
  triggerSource: 'UserMigration_Authentication',
  region: 'us-east-1',
  userPoolId: 'us-east-1_[redacted]',
  userName: 'migrate',
  callerContext: {
    awsSdkVersion: 'aws-sdk-unknown-unknown',
    clientId: [redacted]
  },
  request: { password: [redacted], validationData: null, userAttributes: null },
  response: {
    userAttributes: { email: [redacted]@gmail.com', email_verified: 'true' },
    finalUserStatus: 'CONFIRMED',
    messageAction: 'SUPPRESS'
  }
```

The only required field for signup is an email. This dummy user doesn’t exist in my new user pool and I’ve tried a range of response modifications (like setting forceAliasCreation to be true, adding username as an attribute to the response and response.userAttributes, etc.).

Both source and new Cognito User Pool's app clients have the USER_PASSWORD_AUTH flow enabled for authentication. I’ve checked that my Cognito User Pool allows admin user creation and successfully created a test user in the AWS CLI.

As far as I can tell, my migration Lambda is working correctly but Cognito isn't creating the user, I can’t find any way to troubleshoot from the Cognito-side of things and don’t understand what could be happening.

If anyone had any suggestions for next steps or **any** ideas for what else I could do to troubleshoot this, it would be greatly appreciated!

Kidd Ip · Answer

It may related to missing Required Attributes, even the pool only requires email, Cognito may still expect certain attributes to be present in the response.userAttributes object.

Try including:

```
userAttributes: {
  email: "user@example.com",
  email_verified: "true",
  username: "migrate"
}
```

Also consider adding preferred_username or given_name if your original pool used them.

2. Incorrect Attribute Format
Ensure all attributes are strings and match Cognito's expected format:
- email_verified must be "true" (string), not true (boolean).
- Avoid trailing commas or malformed JSON.

Taz · Answer

Hey,

Hope you're keeping well.

In a Cognito **UserMigration_Authentication** trigger, Cognito only creates the user if the Lambda returns `userAttributes` and sets `finalUserStatus` and `messageAction` correctly, but it also requires that the authentication succeeds. You must set `response.forceAliasCreation` only if migrating aliases, and ensure `response.userAttributes` includes all attributes required by your pool (matching the exact attribute names, e.g. `email` instead of `username`). If your Lambda does not call `context.succeed(event)` with those populated fields before returning, Cognito will silently skip creation.

Thanks and regards,  
Taz

Cognito User Pool migration with Migrate User Lambda Trigger failing without cause.

Add your answer

Relevant content