title: AWS Import Cognito Users with a Temp Password
body: <p>I have been tasked with importing users from an old MYSQL database into AWS Cognito as we are currently building another platform and planning on using SSO across them all.</p>
  <p>Obviously, in the MYSQL database the user has passwords, but what I want to achieve is that after the import has been completed, the user would attempt to sign in and be prompted to create a new password (with no time limit).</p>
  <p>I can see that the PHP SDK contains a <code>AdminSetUserPassword</code> method where I can set <code>Permanent</code> to false, which looks like it puts the status of that user to `FORCE_CHANGE_PASSWORD.</p>
  <p>On the face of it, this looks great, however, the documentation (<a href="https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserPassword.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminSetUserPassword.html</a>) contains a worrying choice of wording:</p>
  <pre><code>If the user does not sign in before it expires, the user will not be able to sign in and their password will need to be reset by an administrator.
  </code></pre>
  <p>What does this mean? Does this mean that if the user signs in for the first time, a countdown starts, and if they do not complete the new password flow (which I will need to setup in the various clients) then the support desk is going to be inundated with calls with users unable to login to their account?</p>
  <p>Or, does <code>and their password will need to be reset by an administrator</code> mean that I can still user the Admin functionality in the SDK to change the users password after the expiry?</p>
  <p>Another issue is, that during import, I am required to sign the user in in order to communicate with the other API's, this will then trigger that sign timer.</p>
  <p>Am I missing any other way of handling this? Essentially, I need to make the whole process as seamless as possible for the users and minimal updates to each of the clients (some are really old codebases, but as they communicate to a older central API I have managed to handle the Cognito auth process via that so haven't had to update the clients yet).</p>