Amazon Cognito
Developer Guide

Pre Authentication Lambda Trigger

Amazon Cognito invokes this trigger when a user attempts to sign in, allowing custom validation to accept or deny the authentication request.

Pre Authentication Lambda Flows

Client Authentication Flow

                    Pre authentication Lambda trigger - client flow

Server Authentication Flow

                    Pre authentication Lambda trigger - server flow

The request includes validation data from the client which comes from the ClientMetadata values passed to the user pool InitiateAuth and AdminInitiateAuth API methods.

For more information, see User Pool Authentication Flow.

Pre Authentication Lambda Trigger Parameters

These are the parameters required by this Lambda function in addition to the common parameters.

{ "request": { "userAttributes": { "string": "string", . . . }, "validationData": { "string": "string", . . . } }, "response": {} }

Pre Authentication Request Parameters


One or more name-value pairs representing user attributes.


One or more key-value pairs containing the validation data in the user's sign-in request. You can pass this data to your Lambda function by using the ClientMetadata parameter in the InitiateAuth and AdminInitiateAuth API actions.

Pre Authentication Response Parameters

No additional return information is expected in the response.

Authentication Tutorials

The pre authentication Lambda function is triggered just before Amazon Cognito signs in a new user. See these sign-in tutorials for JavaScript, Android, and iOS.

Platform Tutorial
JavaScript Identity SDK Sign in users with JavaScript
Android Identity SDK Sign in users with Android
iOS Identity SDK Sign in users with iOS

Pre Authentication Example

This sample function prevents users from a specific user pool app client to sign-in to the user pool.

exports.handler = (event, context, callback) => { if (event.callerContext.clientId === "user-pool-app-client-id-to-be-blocked") { var error = new Error("Cannot authenticate users from this user pool app client"); // Return error to Amazon Cognito callback(error, event); } // Return to Amazon Cognito callback(null, event); };
def lambda_handler(event, context): if event['callerContext']['clientId'] == "<user pool app client id to be blocked>": raise Exception("Cannot authenticate users from this user pool app client") # Return to Amazon Cognito return event

Amazon Cognito passes event information to your Lambda function. The function then returns the same event object back to Amazon Cognito, with any changes in the response. In the Lambda console, you can set up a test event with data that’s relevant to your Lambda trigger. The following is a test event for this code sample:

{ "callerContext": { "clientId": "<user pool app client id to be blocked>" }, "response": {} }