How to change password of AWS Cognito User?

shell amazon-web-services passwords aws-cognito
claudioz picture claudioz · Sep 20, 2017 · Viewed 17.4k times · Source

I'm developing a web application which uses the AWS services backend side. I'm using AWS Cognito to manage the users but I have a problem. When I create a new user (with a temporary password) it is required that I change this password manually to make it definitive. The only way I have to change the password is using AWS Cli, as explained here:

https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/change-password.html

I have to type in the shell the old password, the new password and the Access Token. The problem is: where I find this "Access token"? I don't know what to type in the shell! The AWS Cognito console doen't help.

Answer

Esben von Buchwald picture Esben von Buchwald · Jul 29, 2018

The aws cognito-idp change-password can only be used with a user who is able to sign in, because you need the Access token from aws cognito-idp admin-initiate-auth.

But since the user has a temporary password, it will face the NEW_PASSWORD_REQUIRED challenge when trying to sign in.

Here's how I did it:

$ aws cognito-idp admin-create-user  --user-pool-id USERPOOLID  --username [email protected] --desired-delivery-mediums EMAIL --user-attributes Name=email,[email protected]

$ aws cognito-idp initiate-auth --client-id CLIENTID --auth-flow USER_PASSWORD_AUTH --auth-parameters [email protected],PASSWORD="tempPassword"

Now you get a NEW_PASSWORD_REQUIRED challenge and a very long session token. Use that one to respond to the challenge:

$ aws cognito-idp admin-respond-to-auth-challenge --user-pool-id USERPOOLID --client-id CLIENTID   --challenge-responses "NEW_PASSWORD=LaLaLaLa1234!!!!,[email protected]" --challenge-name NEW_PASSWORD_REQUIRED --session "YourLongSessionToken"

Related questions

How to temporarily switch profiles for AWS CLI?

Edit: Here's the solution that worked for me: export AWS_DEFAULT_PROFILE=user2 The full question is below for context: (1.) After successfully configuring a second profile for the AWS CLI, I unsuccessfully tried to set the profile to user2 in …

Read More
Creating Route53 Record Sets via Shell Script

As a part of my shell script, I am trying to create record sets in AWS Route53. However, using variables in the aws cli within my shell script to create those records set, my variables exported in the Shell scripted …

Read More
How to concatenate string variables in Bash

In PHP, strings are concatenated together as follows: $foo = "Hello"; $foo .= " World"; Here, $foo becomes "Hello World". How is this accomplished in Bash?

Read More