Post Authentication Lambda Trigger - Amazon Cognito
AWS services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with AWS services in China.

Post Authentication Lambda Trigger

Amazon Cognito invokes this trigger after signing in a user, allowing you to add custom logic after authentication.

Post Authentication Lambda Flows

Client Authentication Flow

                    Post authentication Lambda trigger - client flow

Server Authentication Flow

                    Post authentication Lambda trigger - server flow

For more information, see User Pool Authentication Flow.

Post Authentication Lambda Trigger Parameters

These are the parameters required by this Lambda function in addition to the common parameters.

{ "request": { "userAttributes": { "string": "string", . . . }, "newDeviceUsed": boolean, "clientMetadata": { "string": "string", . . . } }, "response": {} }

Post Authentication Request Parameters


This flag indicates if the user has signed in on a new device. It is set only if the remembered devices value of the user pool is set to Always or User Opt-In.


One or more name-value pairs representing user attributes.


One or more key-value pairs that you can provide as custom input to the Lambda function that you specify for the post authentication trigger. You can pass this data to your Lambda function by using the ClientMetadata parameter in the AdminRespondToAuthChallenge and RespondToAuthChallenge API actions.

Post Authentication Response Parameters

No additional return information is expected in the response.

Authentication Tutorials

The post authentication Lambda function is triggered just after Amazon Cognito signs in a new user. See these sign-in tutorials for JavaScript, Android, and iOS.

Platform Tutorial
JavaScript Identity SDK Sign in users with JavaScript
Android Identity SDK Sign in users with Android
iOS Identity SDK Sign in users with iOS

Post Authentication Example

This post authentication sample Lambda function sends data from a successful sign-in to CloudWatch Logs.

exports.handler = (event, context, callback) => { // Send post authentication data to Cloudwatch logs console.log ("Authentication successful"); console.log ("Trigger function =", event.triggerSource); console.log ("User pool = ", event.userPoolId); console.log ("App client ID = ", event.callerContext.clientId); console.log ("User ID = ", event.userName); // Return to Amazon Cognito callback(null, event); };
from __future__ import print_function def lambda_handler(event, context): # Send post authentication data to Cloudwatch logs print ("Authentication successful") print ("Trigger function =", event['triggerSource']) print ("User pool = ", event['userPoolId']) print ("App client ID = ", event['callerContext']['clientId']) print ("User ID = ", event['userName']) # Return to Amazon Cognito return event

Amazon Cognito passes event information to your Lambda function. The function then returns the same event object back to Amazon Cognito, with any changes in the response. In the Lambda console, you can set up a test event with data that’s relevant to your Lambda trigger. The following is a test event for this code sample:

{ "triggerSource": "testTrigger", "userPoolId": "testPool", "userName": "testName", "callerContext": { "clientId": "12345" }, "response": {} }