I have an issue I've been unable to resolve. I'm using AWS Cognito User Pools with a user migration lambda function to import users on the fly. After successfully validating a user's password, I'd like to check if this password meets the requirements Cognito enforces. As per the docs, this should be done in code:

Amazon Cognito doesn't enforce the password strength policy that you configured for the user pool during migration using Lambda trigger. If the password doesn't meet the password policy that you configured, Amazon Cognito still accepts the password so that it can continue to migrate the user. To enforce password strength policy and reject passwords that don't meet the policy, validate the password strength in your code. Then, if the password doesn't meet the policy, set finalUserStatus to RESET_REQUIRED.

However, when I set finalUserStatus to RESET_REQUIRED, I see behavior I don't understand. When logging in for the first time, I see the following, which seems correct:

At this time, I also receive an email with Subject: "Your temporary password" and body: "Your username is ...@gmail.com and temporary password is l6*NWOEp.". I thought this was odd because I hadn't submitted the above form yet. When I enter my email in the above form, I receive:

I don't receive any additional emails. When I fill out this form, I receive the same error.

When I go back to the sign in page and use the temporary password I received in the email, I am forwarded to the first form above: the one with the "Password reset required for user due to security reasons".

Below is the code, I've removed unrelated config and error handling:

export const lambdaHandler = async (event: any, context: any): Promise<any> => {

    if (event.triggerSource == "UserMigration_Authentication") {

        const userName = event.userName;
        const password = event.request.password;

        const user = await authenticateUser(userName, password);

        event.response.userAttributes = {
            "email": user.email,
            "username": user.email,
            "email_verified": "true",
        };

        if (passwordIsWeak(password) { // always true for testing purposes
            event.response.finalUserStatus = "RESET_REQUIRED";
        }

        context.succeed(event);

    }
};

The user in my Cognito User Pool has a Confirmation Status of "Reset required".

I've tried many combinations of finalUserStatus (RESET_REQUIRED, CONFIRMED, FORCE_CHANGE_PASSWORD) and messageAction (SUPPRESS, RESEND) returned in event.response. Anyway, thanks for any help provided!