Cognito "NotAuthorizedException: Incorrect username or password" in CI

By Daniel Zoghalchali·Latchkey

AWS Cognito rejected the sign-in with NotAuthorizedException "Incorrect username or password." The CI test user credentials are wrong, or the user was never confirmed with a permanent password.

What this error means

An InitiateAuth or AdminInitiateAuth call throws "NotAuthorizedException: Incorrect username or password." The seeded user password does not match, or the user is unconfirmed.

NotAuthorizedException: Incorrect username or password.
    at Object.extractError (/app/node_modules/@aws-sdk/client-cognito-identity-provider/...)

Common causes

Wrong test-user password

The password in CI does not match the Cognito user, so authentication fails.

User created without a permanent password

An admin-created user with a temporary password must have it set permanent before password auth succeeds.

How to fix it

Seed a user with a permanent password

1. Create the user, then set a permanent password with admin-set-user-password.
2. Store the credentials as CI secrets.
3. Authenticate with the matching auth flow.

aws cognito-idp admin-set-user-password \
  --user-pool-id "$POOL_ID" --username tester \
  --password "$PASS" --permanent

Confirm the user is CONFIRMED

Ensure the user status is CONFIRMED, not FORCE_CHANGE_PASSWORD, before running sign-in tests.

How to prevent it

• Set a permanent password on seeded Cognito users.
• Keep credentials in CI secrets.
• Assert user status is CONFIRMED during setup.

Frequently asked questions

Related guides

References

• GitHub Actions documentation