oauth-2.0amazon-cognitoopenid-connect

Enabling and Configuring Password History on Cognito


Is it possible to configure password history in such a way that users are prevented from reusing any of their previous passwords? Additionally, can I enforce a policy requiring users to change their password after a specified period of time?


Solution

  • You can prevent users from re-using their passwords by enabling the "Password reuse prevention" that comes as part of the Advanced Security Features. Note, that this comes with extra costs.

    Docs: Password reuse prevention

    Afaik there's no native feature to automatically force password resets after a specific time. You can use the AdminResetUserPassword API to send them a new password, but that may not be really helpful, because it expires within an hour.