Cognito: Cannot create cfn user pool with only email MFA enabled

[dpetzev]

Describe the bug

Trying to create a Cognito user pool using the L1 construct and ONLY email MFA enabled leads to an error in CloudFormation.

This DOES work if I create the same user pool without any MFA enabled and then go to the AWS console and update it manually to have email only MFA.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

CloudFormation is able to create the requested resource without issues.

Current Behavior

Error in CloudFormation with this message:

Resource handler returned message: "SMS configuration and Auto verification for phone_number are required when MFA is required/optional (Service: CognitoIdentityProvider, Status Code: 400, Request ID: ..., HandlerErrorCode: InvalidRequest)

Reproduction Steps

Here is an example of a stack that yields the error in CloudFormation

import * as cognito from 'aws-cdk-lib/aws-cognito';
import { App, Stack, StackProps } from 'aws-cdk-lib/core';

export class AuthStack extends Stack {
  constructor(scope: App, id: string, props: StackProps) {
    super(scope, id, props);

    const userPool = new cognito.CfnUserPool(this, 'UserPool', {
      userPoolName: 'UserPool123',
      adminCreateUserConfig: {
        allowAdminCreateUserOnly: true,
        unusedAccountValidityDays: 1,
      },
      usernameAttributes: ['email'],
      usernameConfiguration: {
        caseSensitive: false,
      },
      enabledMfas: ['EMAIL_OTP'],
      mfaConfiguration: 'OPTIONAL',
    });
  }
}

Possible Solution

No response

Additional Information/Context

Very similar bug, but with OTP only MFA enabled #11478

CDK CLI Version

2.173.2

Framework Version

No response

Node.js Version

v18.19.1

OS

Mac OS

Language

TypeScript

Language Version

No response

Other information

No response