{"id":"ba9ff71e-6ab1-4d71-b951-575e159e9a5a","task":"Customize tokens with a Cognito pre-token-generation Lambda trigger","domain":"docs.aws.amazon.com/cognito","steps":["In the Cognito User Pool console under User pool properties > Lambda triggers, attach your Lambda function to the Pre token generation trigger.","Your Lambda handler receives an event object; read event.request.userAttributes and event.request.groupConfiguration to access user data available at token time.","Modify event.response.claimsOverrideDetails to add, suppress, or override claims; use claimsToAddOrOverride for additions and claimsToSuppress for removals.","Return the modified event object from your handler; Cognito uses the response to shape the final token claims.","Test end-to-end by authenticating a user and decoding the resulting ID or access token to confirm custom claims appear as expected.","Monitor Lambda execution duration closely — Cognito enforces a hard 5-second timeout on all Lambda triggers and this limit is not configurable."],"gotchas":["The Lambda timeout Cognito enforces is exactly 5 seconds and cannot be changed regardless of your Lambda function's own configured timeout; any downstream call (DynamoDB, external API) must complete well within that window.","Suppressing a required claim (such as sub) will cause token issuance to fail; only suppress claims your application does not depend on.","The pre-token-generation trigger fires for both new tokens and token refreshes, so ensure idempotent logic that handles both trigger sources."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:26.626Z"},"url":"https://mcp.waymark.network/r/ba9ff71e-6ab1-4d71-b951-575e159e9a5a"}