AWS Cognito中PASSWORD_VERIFIER后无法触发CUSTOM_CHALLENGE问题

我按照AWS官方指南在AWS Cognito中实现邮箱OTP功能，已配置好用户池与Lambda：

• 可成功触发SRP_A和PASSWORD_VERIFIER步骤，但完成PASSWORD_VERIFIER后直接获得包含访问令牌的AuthenticationResult完成登录，无法进入后续CUSTOM_CHALLENGE流程
• 单独测试CUSTOM_CHALLENGE可正常发送邮箱OTP，但只要结合PASSWORD_VERIFIER就会跳过后续CUSTOM_AUTH流程
• 试过MFA可选和MFA禁用的两个用户池，均存在CUSTOM_AUTH与PASSWORD_VERIFIER不兼容的问题
• 即使修改Lambda中issueTokens为false、failAuthentication为true，输入正确用户名密码完成PASSWORD_VERIFIER后仍会直接登录，跳过其他挑战

我的定义认证Lambda代码如下：

exports.handler = async (event) => {
        if (event.request.session && event.request.session.length === 1
            && event.request.session[0].challengeName === 'SRP_A'
            && event.request.session[0].challengeResult === true) {
            //SRP_A is the first challenge, this will be implemented by cognito. Set next challenge as PASSWORD_VERIFIER.
            event.response.issueTokens = false;
            event.response.failAuthentication = false;
            event.response.challengeName = 'PASSWORD_VERIFIER';
            
        } else if (event.request.session && event.request.session.length === 2
            && event.request.session[1].challengeName === 'PASSWORD_VERIFIER'
            && event.request.session[1].challengeResult === true) {
            //If password verification is successful then set next challenge as CUSTOM_CHALLENGE.
            event.response.issueTokens = false;
            event.response.failAuthentication = false;
            event.response.challengeName = 'CUSTOM_CHALLENGE';
            
        } else if (event.request.session && event.request.session.length >= 5
            && event.request.session.slice(-1)[0].challengeName === 'CUSTOM_CHALLENGE'
            && event.request.session.slice(-1)[0].challengeResult === false) {
            //The user has exhausted 3 attempts to enter correct otp.
            event.response.issueTokens = false;
            event.response.failAuthentication = true;
            
        } else if (event.request.session  && event.request.session.slice(-1)[0].challengeName === 'CUSTOM_CHALLENGE'
            && event.request.session.slice(-1)[0].challengeResult === true) {
            //User entered the correct OTP. Issue tokens.
            event.response.issueTokens = true;
            event.response.failAuthentication = false;
            
        } else {
            //user did not provide a correct answer yet.
            event.response.issueTokens = false;
            event.response.failAuthentication = false;
            event.response.challengeName = 'CUSTOM_CHALLENGE';
        }

        return event;
};

请问是用户池配置有误吗？

内容的提问来源于stack exchange，提问作者Isaac Askew