aws-cognito-admin

Files (2)

• LICENSE
• SKILL.md

SKILL.md (first lines)

# AWS Cognito Admin

Perform Cognito user pool administration without hardcoded pool IDs. All resources are discovered at runtime.

---

## Step 0 — Discover user pools (skip if user already named a pool)

```bash
aws cognito-idp list-user-pools --max-results 60 \
  --query 'UserPools[*].{Name:Name,Id:Id}' \
  --output table --no-cli-pager
```

Present the list and ask the user which pool to work with (or infer from context). If there is only one pool, proceed with it automatically. Store the pool ID as `$POOL_ID` for subsequent commands.

---

## Step 1 — Look up a user by email or username

```bash
aws cognito-idp admin-get-user \
  --user-pool-id "$POOL_ID" \
  --username "$EMAIL_OR_USERNAME" \
  --no-cli-pager
```

Display all attributes clearly. Key things to note:
- `UserStatus` — expected: `CONFIRMED`. Flag `UNCONFIRMED`, `FORCE_CHANGE_PASSWORD`, `DISABLED`, or `UNKNOWN`.
- `Enabled` — if `false`, the account is disabled.
- All `custom:` attributes — these often carry subscription status, plan tier, external IDs (e.g. Stripe customer ID), and role flags. Explain what each likely means.
- `UserCreateDate` and `UserLastModifiedDate` — note if the account is newly created or hasn't been modified in a long time.

---

## Step 2 — List users matching a filter

Use prefix filters for email or other standard attributes:

```bash
aws cognito-idp list-users \
  --user-pool-id "$POOL_ID" \
  --filter 'email ^= "user@example"' \
  --query 'Users[*].{Username:Username,Email:Attributes[?Name==`email`]|[0].Value,Status:UserStatus,Enabled:Enabled}' \
  --output table --no-cli-pager
```

Supported filter operators: `=`, `^=` (starts-with), `$=` (ends-with), `*=` (contains), `!=`.
Filterable attributes: `username`, `email`, `phone_number`, `name`, `given_name`, `family_name`, `preferred_username`, `cognito:user_status`, `status`, `sub`.

---

## Step 3 — Force-confirm an unconfirmed account

Use this when a user did not receive or click their confirmation email but should be activated anyway:

```bash
aws cognito-idp admin-confirm-sign-up \
  --user-pool-id "$POOL_ID" \
  --username "$USERNAME" \
  --no-cli-pager
```

After running, re-fetch the user (Step 1) and confirm `UserStatus` is now `CONFIRMED`.

---

## Step 4 — Reset a user's password

Sends a temporary password reset code to the user's registered email or phone:

```bash
aws cognito-idp admin-reset-user-password \
  --user-pool-id "$POOL_ID" \
  --username "$USERNAME" \
  --no-cli-pager
```

After running, the user will receive a reset code and their status will change to `RESET_REQUIRED`. Let the user know to check their inbox.

---

## Step 5 — Disable or enable a user

**Disable** (blocks all sign-in immediately):

```bash
aws cognito-idp admin-disable-user \
  --user-pool-id "$POOL_ID" \
  --username "$USERNAME" \
  --no-cli-pager
```

**Enable** (restores sign-in access):

```bash
aws cognito-idp admin-enable-user \
  --user-pool-id "$POOL_ID" \
  --username "$USERNAME" \
  --no-cli-pager
```

Disabling does not delete the user or their attributes. Existing sessions may remain valid until they expire — Cognito does not invalidate tokens on disable.

---

## Step 6 — Update a custom attribute

Use this to manually fix subscription status, plan tier, role flags, or any other custom attribute:

```bash
aws cognito-idp admin-update-user-attributes \
  --user-pool-id "$POOL_ID" \
  --username "$USERNAME" \
  --user-attributes Name="custom:subscription_status",Value="active" \
  --no-cli-pager
```

To update multiple attributes at once, repeat `Name=...,Value=...` entries:

From Kilo-Org/kilo-marketplace, Apache-2.0.

More from Kilo-Org/kilo-marketplace