AWS First Steps
New feature

Amazon Cognito adds admin API operation to reset user TOTP configurations

Amazon Cognito now offers an admin API to reset user TOTP MFA settings, simplifying recovery for users who lose access to their TOTP device

Amazon Cognito introduces a new admin API operation that allows administrators to reset a user's time-based one-time password (TOTP) multi-factor authentication (MFA) configuration. This enables users to enroll a new device during their next sign-in if they lose access to their TOTP device, eliminating the need to recreate accounts for recovery while maintaining MFA enforcement. The feature is available in all AWS regions where Amazon Cognito operates, accessible via the AdminDeleteSoftwareToken API through AWS CLI, SDKs, or APIs. See the developer guide for instructions.

Why it matters

This update provides a recovery method for users who lose access to their TOTP device, balancing security with usability

Read the original AWS announcement

Related articles and terms

Implementing User Authentication - Building a Secure Authentication Foundation with CognitoLearn how to design and implement a user authentication foundation using Amazon Cognito, including building authentication flows with user pools, identity pools, and external identity provider federation.Amazon CognitoA fully managed service that adds user authentication and authorization to web and mobile applications, with support for social login and SAML federationImplementing User Authentication with Amazon Cognito - Designing User Pools and Identity PoolsLearn about user authentication with Cognito User Pools, AWS resource access with Identity Pools, and social login integration.Designing Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.Why the AWS Account Root User Is Dangerous - The Design Philosophy of Privilege Separation and Practical LockdownWe explain why the AWS root user holds privileges that cannot be restricted by IAM, list the operations only the root user can perform, cover MFA setup methods, and describe the lockdown strategy using Organizations' centralized root access management.