I am setting up Amazon Cognito for authentication to use a Kibana instance. I only permit administrators to create users, and I permit only the Cognito User Pool identity provider. When creating the user pool, I set Multi-Factor Authentication to "required" and enabled only the "Time-based One-time Password" option. I use an Amazon Cognito domain for the sign-in page.

When I create a Cognito user from the AWS Console, I send the invitation by email. When going to the Kibana URL, the server redirects to the Cognito sign-in page as expected. After login with the temporary password in the email, the user is required to change the password, then attempt login again.

The problem is that MFA is required, but the user has no opportunity to set up a TOTP application. I would have expected TOTP setup to follow the required password change. Instead, Cognito rejects the login for not having MFA enabled:

You must have multi-factor authentication (MFA) set up to sign in. Please set up MFA and try again.

Cognito login error message for lack of MFA

Managing the user in the AWS Console shows an option to enable SMS MFA. But, I'm not using SMS.

User-management UI

The TOTP Software Token MFA documentation states:

When your user chooses TOTP software token MFA, call AssociateSoftwareToken to return a unique generated shared secret key code for the user account. The request for this API method takes an access token or a session string, but not both. As a convenience, you can distribute the secret key as a quick response (QR) code.

But that sounds like I need to make an API call somehow after the user "chooses" TOTP. I'm not writing my own application that could make the API call -- this authentication is only for accessing the Kibana instance provided with Amazon Elasticsearch Service.

How can users initialize TOTP so they can use it to complete login as required?

  • Can you set MFA to optional, then enable after? It sounds like the built in template doesn't allow the use case you have described. Also, might get more help with this sort of question on SO. Commented Apr 8, 2019 at 2:05
  • @comfytoday No. "You can only choose MFA as Required when you initially create a user pool." I didn't post to SO because it's not really a code question.
    – Andrew
    Commented Apr 9, 2019 at 15:25
  • There is quite a bit of Cognito activity on SO, I think it might be relevant... even if just to confirm if you need to write code or not... here is relevant question: stackoverflow.com/questions/51643885/… Commented Apr 9, 2019 at 21:45
  • I have the same issue. Standard UI does not provide anything regarding TOTP
    – Gino Pane
    Commented Feb 25, 2021 at 17:24


You must log in to answer this question.

Browse other questions tagged .