Read through other SO posts, implemented the solutions, and this still seems to be an error.
My issue is simple: I'm using AWS Cognito and requiring email verification for users. However, when I get to this page:
I don't see the email, even after 2 hours. Steps I've ensured:
Enabled email verification in the Cognito console
Checked that the user email field is filled out. It is.
Enabled a domain name for my app sign up and sign in.
Tried resending the code.
I don't believe I'm over the daily quota limit for Amazon Cognito (I haven't configured it with SES), since I haven't gotten verification email today. Does anyone know why this is occuring?
I want to change the email template with both apis(signup, forgotPassword) of AWS Cognito. because I need to add a link to the code verify on that pages.
The best way to go is using 3rd party providers for sending Emails in Cognito. This can be done with a custom lambda EmailCustomSender, but it can be only set by the console.
I am happy with using AWS Cognito as a service for my flutter application. However, now I realize that the AWS SNS service is really pricey for usage within my country (No free tier and price is significantly higher than in the West), hence I wanted to use another 3rd party service which is cheaper to send any SMS to users. This will include Phone Number Verification during signup, Forgot Password Verification and other flows. I know that I can accomplish the phone number verification using the lambda function. However, for the forgot password flow, the only way of me changing the password is through sending a request to AWS which includes the OTP and new password.
How can I accomplish this? Can I change the user password explicitly in AWS by not going through the forgot_password flow in AWS (Meaning I send my own OTP and check the OTP myself, then updates the password), or how can I get the OTP generated by the forgot password then send it through the 3rd party SMS service?
I have bought a domain,then I have created domain identity in SES and verified it successfully, now comes the email part. I have created email address in identity management that is user#example.com (assume that example.com is my domain), documentation states that I need to go to the email inbox and click on the email but what inbox they mean? How can I access this inbox of this address that I've just created? If I have to use my own email here then what's the point of adding a domain If I can use gmail smtp straight away? Can someone please clarify this?
Here is the clear answer:
At first, you need to purchase and verify your domain in SES(you've done this already, it's good to go for next step)
You need to write a support ticket to move your SES account out from sandbox mode as it's in sandbox mode by default(You need to provide all info AWS requires in detail)
moving out from sandbox mode
This might take 1 day around, finally you can get production SES status and check in your statistics section from SES console.
Next, you need to go AWS WorkMail service console and create your email accounts to be used for sender or receiver in your platform by your purchased domain(i.e, if your domain is abc.com, info#abc.com or support#abc.com).
When I say creating email accounts, it says you need to create email address, username and password for each email account.
Finally, If you need to check out the inbox for above created accounts, WorkMail provides a cool web client for it.
Here is the WorkMail web client documentation from AWS
It says this:
The web client URL looks like this: https://alias.awsapps.com/mail. Replace alias with the alias you received from your site administrator.
Here, alias is configured by you when you create your organization in WorkMail console.
The reason why SES requires to verify domain is something like ID verification of email sender, and verification of 3rd party email addresses gives us a flexibility to work with any other email addresses not registered in SES, also allow development and test before registration of domain in sandbox mode.
Cheers
The email address you want to verify must have existing mail service, before you can validate the address in SES.
From AWS docs, about receiving email
https://docs.aws.amazon.com/ses/latest/DeveloperGuide/receiving-email.html
When you receive email, Amazon SES processes it according to instructions you provide. For example, Amazon SES can deliver incoming mail to an Amazon S3 bucket, publish it to an Amazon SNS topic, or send it to Amazon WorkMail.
If you need an inbox service, use Amazon WorkMail.
Creating a IAM user doesn't create an inbox. And SES has no inbox capability at all. The point of validation is to allow sending in behalf of the service. In certain use cases, you can process inbound email via Lambda, store attachments on S3 etc. but there is no POP3/IMAP inbox-like service included in the SES.
Creating an IAM user is not required to validate your email. That is only for authentication purposes for accessing AWS account services.
AWS SES can receive emails and mostly this is used for automated email processing.
If you have verified in identity that you own the domain(by adding txt record in your domain DNS table) then by default you have verified all emails that fall in that domain.
You don't have to follow the steps to verify individual emails by clicking the link received on the emails.
https://docs.aws.amazon.com/ses/latest/DeveloperGuide/verify-domains.html
From your example: since the domain examaple.com is verified, you don't have to again verify emails(user#example.com) that fall under same domain.
Individual email verification is for scenarios where you cant verify domain by placing dns records. Here you will not be able to receive emails, but if you still want to send emails from an address then you can verify it by clicking the link you receive on your inbox. This can be done with gmail or other mail providers.
We have an application using AWS Cognito (+ hosted web UI) where users are only created by administrators. MFA with SMS is required. This is our current flow for new users:
Admin creates a new user using AdminCreateUser of aws-sdk. Email, name and phone number are given.
A new account is created with FORCE_CHANGE_PASSWORD status. Username and a temporary password are sent to the user via email.
User signs in for the first time with the temporary password.
Cognito asks for a new password.
User sets their new password and proceeds to log in.
MFA code is sent to user via SMS. However, Cognito does not ask for the MFA code. User simply gets logged in. Account status is now CONFIRMED but phone_number_verified is not set.
However, the MFA challenge works fine starting from the second login. In other words, user's phone number only gets verified if they manage to log in for the second time. This means that a user who forgets their password after the initial login is unable to reset their password (as it requires a verified phone number).
Any idea why this is happening and what settings should I look into? I'm aware I can avoid the main problem by programmatically setting phone_number_verified as true, but I'd like to know why the MFA challenge fails on first login.
I've been really disappointed in the AWS hostsed auth UI. It's ugly and very limited. As you've discovered, for example, it doesn't handle MFA at all.
The best alternative I've found is to use the Authenticator Amplify UI component. It's possible to use Amplify UI without using the Amplify CLI or hosting your site on AWS, so it's pretty well a drop-in solution. Authenticator handles setting up software TOTP tokens and the TOTP challenge as needed. I haven't used it for SMS, but this page implies it's supported.
You can learn how to use Amplify UI components standalone (without the CLI and AWS hosting) in this StackOverflow answer.