Cognito user pool creation with MFA (TOTP) required via CLI

Question

I am trying to set up a user pool for AWS Cognito via the AWS CLI. I would like to only allow authentication via MFA (via TOTP, not via SMS).

However, if I set --mfa-configuration ON, I receive the following error message:

An error occurred (InvalidParameterException) when calling the CreateUserPool operation: 
SMS configuration and Auto verification for phone_number are required when MFA is required/optional

How can I set TOTP as MFA requirement via AWS CLI? I am using aws-cli v. 2.15.19.

Thank you very much!

Answer 1

I found an answer to my question.

The MFA setup can be done in a separate step:

aws cognito-idp set-user-pool-mfa-config \
  --user-pool-id <COGNITO_POOL_ID> \
  --mfa-configuration ON \
  --software-token-mfa-configuration Enabled=true