title: AWS Cognito: how to allow users to change email without verification?
body: <p>I'm new to AWS and I'm looking for a way to allow the users of my Android app to change their emails without going through the verification process (I managed to do it for the subscription).</p>
  
  <p>I tried to follow <a href="https://github.com/aws-amplify/amplify-js/issues/987" rel="noreferrer">this</a> and <a href="https://github.com/amazon-archives/amazon-cognito-identity-js/issues/322" rel="noreferrer">this</a>, and here is what I did.</p>
  
  <p>In my Android app:</p>
  
  <pre class="lang-java prettyprint-override"><code>public void onClickChangeEmail(View view)
  {
      CognitoUserAttributes attributes = new CognitoUserAttributes();
      attributes.getAttributes().put("email", "second@mail.com");
      CognitoSettings
              .getCognitoUserPool(MainActivity.this)
              .getCurrentUser()
              .updateAttributesInBackground(attributes, new UpdateAttributesHandler()
      {
          @Override
          public void onSuccess(List&lt;CognitoUserCodeDeliveryDetails&gt; attributesVerificationList)
          {
              Log.i("tag", "Email updated!");
          }
  
          @Override
          public void onFailure(Exception e)
          {
              e.printStackTrace();
          }
      });
  }
  </code></pre>
  
  <p>Then, in my AWS console, I added a trigger in Cognito on <em>Custom message</em>, and here is my lambda function, which is triggered everytime a user updates his email:</p>
  
  <pre class="lang-js prettyprint-override"><code>const AWS = require('aws-sdk')
  AWS.config.update({region: 'eu-central-1'});
  
  exports.handler = (event, context, callback) =&gt; {
      if (event.triggerSource === 'CustomMessage_UpdateUserAttribute')
      {
          const params = {
              UserAttributes: [
                {
                    Name: 'email_verified',
                    Value: 'true',
                },
              ],
              UserPoolId: event.userPoolId,
              Username: event.userName,
          };
          var cognitoIdServiceProvider = new AWS.CognitoIdentityServiceProvider();
          cognitoIdServiceProvider.adminUpdateUserAttributes(params, function(err, data) {
              if (err) context.done(err, event); // an error occurred
              else context.done(null, event); // successful response
          });
      }
      else
      {
          context.done(null, event);
      }
  };
  </code></pre>
  
  <p>The result is: the email is properly updated (but it works whithout the lambda), but the lambda crashes, with the following error:</p>
  
  <p><code>autoValidationUserEmailModification is not authorized to perform: cognito-idp:AdminUpdateUserAttributes</code></p>
  
  <p>So it looks like an authorization is missing.</p>
  
  <p>My questions are:</p>
  
  <ul>
  <li>How can I fix the authorization part?</li>
  <li>Is that method the right way to disable email verification on updating user email?</li>
  </ul>
  
  <p>Thanks for your help.</p>