set_user_pool_mfa_config ¶

def set_user_pool_mfa_config(
    self,
    user_pool_id: "capo_cognito_identity_provider.types.user_pool_id_type.UserPoolIdType",
    *,
    config_overrides: Optional[CognitoIdentityProviderClientConfig] = None,
    sms_mfa_configuration: Optional[
        "capo_cognito_identity_provider.types.sms_mfa_config_type.SmsMfaConfigType"
    ] = None,
    software_token_mfa_configuration: Optional[
        "capo_cognito_identity_provider.types.software_token_mfa_config_type.SoftwareTokenMfaConfigType"
    ] = None,
    email_mfa_configuration: Optional[
        "capo_cognito_identity_provider.types.email_mfa_config_type.EmailMfaConfigType"
    ] = None,
    mfa_configuration: Optional[
        "capo_cognito_identity_provider.types.user_pool_mfa_type.UserPoolMfaType"
    ] = None,
    web_authn_configuration: Optional[
        "capo_cognito_identity_provider.types.web_authn_configuration_type.WebAuthnConfigurationType"
    ] = None,
) -> "capo_cognito_identity_provider.types.set_user_pool_mfa_config_response.SetUserPoolMfaConfigResponse":
    """<p>Sets user pool multi-factor authentication (MFA) and passkey configuration. For more information about user pool MFA, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-mfa.html">Adding MFA</a>. For more information about WebAuthn passkeys see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-authentication-flow-methods.html#amazon-cognito-user-pools-authentication-flow-methods-passkey">Authentication flows</a>.</p> <note> <p>This action might generate an SMS text message. Starting June 1, 2021, US telecom carriers require you to register an origination phone number before you can send SMS messages to US phone numbers. If you use SMS text messages in Amazon Cognito, you must register a phone number with <a href="https://console.aws.amazon.com/pinpoint/home/">Amazon Pinpoint</a>. Amazon Cognito uses the registered number automatically. Otherwise, Amazon Cognito users who must receive SMS messages might not be able to sign up, activate their accounts, or sign in.</p> <p>If you have never used SMS text messages with Amazon Cognito or any other Amazon Web Services service, Amazon Simple Notification Service might place your account in the SMS sandbox. In <i> <a href="https://docs.aws.amazon.com/sns/latest/dg/sns-sms-sandbox.html">sandbox mode</a> </i>, you can send messages only to verified phone numbers. After you test your app while in the sandbox environment, you can move out of the sandbox and into production. For more information, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-sms-settings.html"> SMS message settings for Amazon Cognito user pools</a> in the <i>Amazon Cognito Developer Guide</i>.</p> </note>

    Args:
        user_pool_id: <p>The user pool ID.</p>
        sms_mfa_configuration: <p>Configures user pool SMS messages for MFA. Sets the message template and the SMS message sending configuration for Amazon SNS.</p>
        software_token_mfa_configuration: <p>Configures a user pool for time-based one-time password (TOTP) MFA. Enables or disables TOTP.</p>
        email_mfa_configuration: <p>Sets configuration for user pool email message MFA and sign-in with one-time passwords (OTPs). Includes the subject and body of the email message template for sign-in and MFA messages. To activate this setting, your user pool must be in the <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/feature-plans-features-essentials.html"> Essentials tier</a> or higher.</p>
        mfa_configuration: <p>Sets multi-factor authentication (MFA) to be on, off, or optional. When <code>ON</code>, all users must set up MFA before they can sign in. When <code>OPTIONAL</code>, your application must make a client-side determination of whether a user wants to register an MFA device. For user pools with adaptive authentication with threat protection, choose <code>OPTIONAL</code>.</p> <p>When <code>MfaConfiguration</code> is <code>OPTIONAL</code>, managed login doesn't automatically prompt users to set up MFA. Amazon Cognito generates MFA prompts in API responses and in managed login for users who have chosen and configured a preferred MFA factor.</p>
        web_authn_configuration: <p>The configuration of your user pool for passkey, or WebAuthn, authentication and registration. Includes relying-party configuration, user-verification requirements, and whether passkeys can satisfy MFA requirements.</p>

    Raises:
        capo_cognito_identity_provider.errors.concurrent_modification_exception.ConcurrentModificationException: <p>This exception is thrown if two or more modifications are happening concurrently.</p>
        capo_cognito_identity_provider.errors.feature_unavailable_in_tier_exception.FeatureUnavailableInTierException: <p>This exception is thrown when a feature that you attempted to use or configure isn't included in your user pool's current feature plan. This can occur when:</p> <ul> <li> <p>You configure a feature that your feature plan doesn't support.</p> </li> <li> <p>You make a request that uses a feature that requires a higher feature plan.</p> </li> </ul> <p>To resolve this issue, upgrade your user pool to a feature plan that includes the feature.</p>
        capo_cognito_identity_provider.errors.internal_error_exception.InternalErrorException: <p>This exception is thrown when Amazon Cognito encounters an internal error.</p>
        capo_cognito_identity_provider.errors.invalid_parameter_exception.InvalidParameterException: <p>This exception is thrown when the Amazon Cognito service encounters an invalid parameter.</p>
        capo_cognito_identity_provider.errors.invalid_sms_role_access_policy_exception.InvalidSmsRoleAccessPolicyException: <p>This exception is returned when the role provided for SMS configuration doesn't have permission to publish using Amazon SNS.</p>
        capo_cognito_identity_provider.errors.invalid_sms_role_trust_relationship_exception.InvalidSmsRoleTrustRelationshipException: <p>This exception is thrown when the trust relationship is not valid for the role provided for SMS configuration. This can happen if you don't trust <code>cognito-idp.amazonaws.com</code> or the external ID provided in the role does not match what is provided in the SMS configuration for the user pool.</p>
        capo_cognito_identity_provider.errors.not_authorized_exception.NotAuthorizedException: <p>This exception is thrown when a user isn't authorized.</p>
        capo_cognito_identity_provider.errors.operation_not_enabled_exception.OperationNotEnabledException: <p>This exception is thrown when an operation is not available in the current region or for the current user pool configuration. This can occur when attempting to perform operations that are not supported in secondary replica regions.</p>
        capo_cognito_identity_provider.errors.resource_not_found_exception.ResourceNotFoundException: <p>This exception is thrown when the Amazon Cognito service can't find the requested resource.</p>
        capo_cognito_identity_provider.errors.too_many_requests_exception.TooManyRequestsException: <p>This exception is thrown when the user has made too many requests for a given operation.</p>
        capo_cognito_identity_provider.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_cognito_identity_provider.types.set_user_pool_mfa_config_request.SetUserPoolMfaConfigRequest]",
    ) -> OperationResponse[
        "capo_cognito_identity_provider.types.set_user_pool_mfa_config_response.SetUserPoolMfaConfigResponse"
    ]:
        import capo_cognito_identity_provider._operations.aws_cognito_identity_provider_service.set_user_pool_mfa_config

        output, http_response = (
            capo_cognito_identity_provider._operations.aws_cognito_identity_provider_service.set_user_pool_mfa_config.set_user_pool_mfa_config(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("SetUserPoolMfaConfig")
    )
    input_: capo_cognito_identity_provider.types.set_user_pool_mfa_config_request.SetUserPoolMfaConfigRequest = {
        "user_pool_id": user_pool_id
    }
    if sms_mfa_configuration is not None:
        input_["sms_mfa_configuration"] = sms_mfa_configuration
    if software_token_mfa_configuration is not None:
        input_["software_token_mfa_configuration"] = (
            software_token_mfa_configuration
        )
    if email_mfa_configuration is not None:
        input_["email_mfa_configuration"] = email_mfa_configuration
    if mfa_configuration is not None:
        input_["mfa_configuration"] = mfa_configuration
    if web_authn_configuration is not None:
        input_["web_authn_configuration"] = web_authn_configuration

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output