AWS Cognito控制台复选框无法选中问题求助：Root用户无法管理用户池登录选项

Hey there, let's break down why those login option checkboxes are locked up on you—even when you're signed in as the root user. Here are the most common culprits and fixes:

• Your user pool was created via bulk user import
  If you set up the user pool by importing users from a CSV instead of creating an empty pool first, AWS locks some login configuration options by default. This is because imported users might not have verified attributes (like email/phone) required for certain login methods.
  Fix: Try updating the login options via the AWS CLI instead of the console. For example, to enable email and phone number as login attributes, run:

  aws cognito-idp update-user-pool --user-pool-id YOUR_POOL_ID --username-attributes email phone_number
  

  After running this, refresh the console—you should see the checkboxes unlocked.

• The user pool is linked to dependent services
  If your user pool is already connected to app clients, Lambda triggers, or other AWS services (like Amplify or API Gateway), the console locks critical settings to avoid breaking existing integrations.
  Fix: Head over to the App clients tab in your user pool and temporarily disable or delete any test clients you don't need. Then check the Triggers tab—disable any pre-authentication or authentication triggers temporarily. Once done, try modifying the login options again.

• Browser cache or regional mismatch
  Sometimes AWS Console glitches due to cached data. Or you might be in the wrong AWS region (easy mistake for new users!).
  Fix: Clear your browser cache, open an incognito window, and log back in. Double-check that you're in the same region where your user pool was created.

• AWS Organizations service control policy (SCP) restrictions
  If your AWS account is part of an organization, an admin might have set up an SCP that blocks modifications to Cognito user pools. Even root users can't bypass these policies.
  Fix: Reach out to your organization's admin to check if there's an SCP restricting actions like cognito-idp:UpdateUserPool. If so, they'll need to adjust the policy to allow the changes you need.

内容的提问来源于stack exchange，提问作者Lev Martens