How to detect password change in Post Confirmation Lambda Trigger?

Question:

I’m triggering a Lambda when a user registers to make an entry to a database. Post Confirmation Lambda Trigger triggers fine, there are no problems with it. Now, after implementing a password change form I’m seeing the same Lambda triggered.

In fact, AWS states that it should – it’s “Post Confirmation” and so when the user confirms his email retyping sent code, it triggers. I’m fine with that.

How to recognise, in the Lambda, what was the reason for firing the trigger? I don’t want to make the same DB calls when it’s just a password change.

(I checked the request coming in – there’s nothing useful for that problem there)

Answer:

To differentiate the source on a PostConfirmation, you have to use the "triggerSource": "string" attribute in the event object.

The trigger source can be PostConfirmation_ConfirmForgotPassword or PostConfirmation_ConfirmSignUp for a PostConfirmation.

The event object will be of the format:

reference: https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-identity-pools-working-with-aws-lambda-triggers.html#cognito-user-identity-pools-working-with-aws-lambda-trigger-sources

Leave a Reply