Cognito save changes in user pool is not working

Question

We are using cognito user pool for authentication and I had enabled email verification under MFA and verification , so after some time I am trying remove that verification by unchecking the email check box , I always get an error Your roles are still being created. Please wait and try again . I waited for week , still the problem persists. I just need to uncheck email verification. Thank you in advance.

Answer 1

I had an issue where the SMS role was accidentally deleted. It may have never been created either. At the bottom of the MFA section you'll see an input box with the ability to name the role and then a button "Create Role" to click on.

If you have a grayed out role name already. Look for it in IAM. If it doesn't exist, you will need to re-create it. Unfortunately there is no way to do this in IAM and have it work for Cognito because it requires a path prefix for the service role (of service-role). I tried re-creating via CLI and while it made the matching role, it still didn't work.

So the best thing to do is make a new (dummy) pool and create the SMS role there that matches the name of the one used by the other pool where you're seeing that error message.

Then you will need to update the role to ensure the ExternalId matches (it's a UUID). The only way you can find this UUID is via CLI, so you'll need to find it using the command: aws cognito-idp get-user-pool-mfa-config --user-pool-id=xxxx

It should return the current role name and it's ExternalId so you can then go back to IAM and find the newly AWS created SMS role and update it's policy JSON to include the proper UUID.

Finally, get rid of the dummy pool you had created because it too will now be afflicted with the "Your roles are still being created." bug.

Essentially, it's just stuck and needs it's config pointed to the proper role (using it's ExternalId) and unfortunately there's not enough dashboard controls to fix the issue. You have to kinda hack around it a little bit until they can fix it.