If you see the error message saying that a user “does not have delivery config set to turn on SOFTWARE_TOKEN_MFA,” it usually means the user hasn’t finished setting up their TOTP (Time-based One-Time Password) device before trying to enable multi-factor authentication (MFA). Setting up MFA with TOTP in Cognito involves following a specific order, and skipping steps can cause this kind of error.
Here’s what you need to do to fix it:
First, make sure that MFA with authenticator apps is turned on at the user pool level. In the AWS Console:
- Go to Amazon Cognito
- Select your user pool
- Click on the Sign-in experience tab
- Under Multi-factor authentication, check “Authenticator apps (TOTP)” to enable it
- Decide if MFA should be required or optional for users
Next, the user has to associate a TOTP token. This is often the step people forget, leading to the error. The user needs to complete a process involving two steps—associating the token and verifying it—before MFA can be activated.
If you’re using the AWS CLI, here are the steps:
- Start an authentication session for the user:
aws cognito-idp admin-initiate-auth \
–user-pool-id us-east-1_@@@@ \
–client-id your-app-client-id \
–auth-flow ADMIN_USER_PASSWORD_AUTH \
–auth-parameters USERNAME=theuser,PASSWORD=theirpassword
- Use the session token from the previous step to associate a software token:
aws cognito-idp associate-software-token \
–session “session-string-from-step-1”
This returns a SecretCode. The user scans this code as a QR code in their authenticator app like Google Authenticator or Authy.
- The user then verifies the token by entering a code from their authenticator app:
aws cognito-idp verify-software-token \
–session “session-string-from-step-2” \
–user-code 123456
- After successful verification, you can set the user’s MFA preferences:
aws cognito-idp admin-set-user-mfa-preference \
–user-pool-id us-east-1_@@@@ \
–username theuser \
–software-token-mfa-settings Enabled=true,PreferredMfa=true
Alternatively, if the user is already signed in with valid credentials, you can let them set up MFA through your app:
- Associate the software token:
aws cognito-idp associate-software-token \
–access-token “user-access-token”
- Verify the token:
aws cognito-idp verify-software-token \
–access-token “user-access-token” \
–user-code 123456
- Set their MFA preference:
aws cognito-idp set-user-mfa-preference \
–access-token “user-access-token” \
–software-token-mfa-settings Enabled=true,PreferredMfa=true
It’s important to understand why the console alone isn’t enough. When you try to enable MFA via the AWS Management Console, it only updates the MFA preferences and skips the token association part. Without associating a TOTP device, Cognito rejects the setting. This is a known issue with the user experience in the console.
For more details, you can check the official AWS documentation on setting up MFA with TOTP: AWS Documentation on MFA Setup.