JA EN
shiichan

Cognito Users No Longer Need a New Account After Losing Their TOTP Device!

AWS What's New ★★★★ View Markdown
#aws#security#devops

Hi, it's me, Shiichan! Today I found a small but genuinely useful update to Amazon Cognito, so let me walk you through it.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon Cognito now offers a new admin API operation to reset a user's TOTP (time-based one-time password) MFA configuration. When a user loses access to their TOTP device — like their authenticator app phone — an administrator can remove that device's association. The user can then enroll a new device the next time they sign in.

The story so far

Until now, there wasn't a clean way for administrators to just unhook a lost TOTP device and let the user re-enroll. If a user got locked out of MFA because they lost their device, admins had to fall back on recreating the account entirely to recover access — a heavier operation than it needed to be, especially when the goal was simply to restore a single user's sign-in path while keeping MFA in place.

What changes

With the new API, admins can now surgically remove just the TOTP association for a locked-out user, instead of recreating the account. That should cut down on support overhead. Just as importantly, MFA enforcement stays intact throughout — there's no need to temporarily relax security just to get a user back in.

Dive Deep

The new operation is called AdminDeleteSoftwareToken, and it's accessible via the AWS CLI, SDKs, or APIs.

AdminDeleteSoftwareToken

This capability is available in all AWS Regions where Amazon Cognito is available. For setup details, check the API reference and the developer guide section on user pool MFA / TOTP configuration.

Wrap-up

  • Amazon Cognito added a new admin API, AdminDeleteSoftwareToken, to reset a user's TOTP MFA configuration.
  • Users who lose their TOTP device can now recover by re-enrolling a new one, without needing their account recreated.
  • MFA enforcement stays intact throughout the recovery process.
  • It's callable via AWS CLI, SDKs, or APIs, and available in every AWS Region where Cognito runs.
  • A small but welcome win for anyone running MFA and handling account-recovery support for Cognito user pools.

Related posts