Skip to main content

Cognito

Quick Reference

# List user pools
aws cognito-idp list-user-pools --max-results 10

# Describe user pool
aws cognito-idp describe-user-pool --user-pool-id us-east-1_0KxUx0aXg

# List users in pool
aws cognito-idp list-users --user-pool-id us-east-1_0KxUx0aXg --limit 10

# Find a user by email
aws cognito-idp list-users --user-pool-id us-east-1_0KxUx0aXg \
--filter "email = \"user@example.com\""

# Get user details
aws cognito-idp admin-get-user --user-pool-id us-east-1_0KxUx0aXg --username {username}

# List user pool clients
aws cognito-idp list-user-pool-clients --user-pool-id us-east-1_0KxUx0aXg

User Pools

There are two separate Cognito setups:

  1. Console (infra/aws) - For the web console at console.control-plane.marqo-staging.com
  2. Controller (infra/controller) - For the cloud controller at controller.marqo-staging.com

Controller Pool (Staging)

  • Pool ID: us-east-1_0KxUx0aXg (imported, not CDK-managed)
  • Sign-in: Email-based
  • MFA: Optional (OTP only)
  • Google SSO: Enabled
  • Custom domain: auth.controller.marqo-staging.com

Custom Attributes

AttributePurpose
sys_acc_idSystem account ID
cus_vis_acc_idCustomer-visible account ID
cell_idControl plane cell ID
stripe_idStripe customer ID
organizationOrganization name
roleUser role

Lambda Triggers

Cognito trigger Lambdas have CDK-generated names (not {env}- prefixed). Find them via the user pool config or by searching:

aws cognito-idp list-user-pools --max-results 10 --query "UserPools[?contains(Name, 'staging')].LambdaConfig"
TriggerName containsPurpose
Pre Sign-UpPreSignupAuto-confirm, link Google identity
Custom MessageCustomMessageCustomize invitation/verification emails
Post ConfirmationPostConfirmationSlack notification on new signup
Define Auth ChallengeDefineAuthChallengeCustom auth flow

What to Look For

SymptomCheck
User can't sign inadmin-get-user to check status, check trigger Lambda logs
Invitation email not sentCheck CustomMessageLambda logs, verify SES config
Google SSO brokenCheck Google identity provider config, verify secrets in Secrets Manager
Account not createdCheck PostConfirmationLambda logs (may fail to notify Slack silently)