aws-cognito-admin

AWS Cognito Admin

Perform Cognito user pool administration without hardcoded pool IDs. All resources are discovered at runtime.

---

Step 0 — Discover user pools (skip if user already named a pool)

aws cognito-idp list-user-pools --max-results 60 \
  --query 'UserPools[*].{Name:Name,Id:Id}' \
  --output table --no-cli-pager

Present the list and ask the user which pool to work with (or infer from context). If there is only one pool, proceed with it automatically. Store the pool ID as $POOL_ID for subsequent commands.

---

Step 1 — Look up a user by email or username

aws cognito-idp admin-get-user \
  --user-pool-id "$POOL_ID" \
  --username "$EMAIL_OR_USERNAME" \
  --no-cli-pager

Display all attributes clearly. Key things to note:

• UserStatus — expected: CONFIRMED. Flag UNCONFIRMED, FORCE_CHANGE_PASSWORD, DISABLED, or UNKNOWN.
• Enabled — if false, the account is disabled.
• All custom: attributes — these often carry subscription status, plan tier, external IDs (e.g. Stripe customer ID), and role flags. Explain what each likely means.
• UserCreateDate and UserLastModifiedDate — note if the account is newly created or hasn't been modified in a long time.

---

Step 2 — List users matching a filter

Use prefix filters for email or other standard attributes:

aws cognito-idp list-users \
  --user-pool-id "$POOL_ID" \
  --filter 'email ^= "user@example"' \
  --query 'Users[*].{Username:Username,Email:Attributes[?Name==`email`]|[0].Value,Status:UserStatus,Enabled:Enabled}' \
  --output table --no-cli-pager

Supported filter operators: =, ^= (starts-with), $= (ends-with), *= (contains), !=. Filterable attributes: username, email, phone_number, name, given_name, family_name, preferred_username, cognito:user_status, status, sub.

---

Step 3 — Force-confirm an unconfirmed account

Use this when a user did not receive or click their confirmation email but should be activated anyway: