send email when user registers - AWS Cognito federated Identities

Question

How can i send an email/trigger a lambda function when a new user registers?

Under "edit identity pool" i only found a sync trigger. If i understand correctly: This one is triggered every time a user syncs his data...
Is there any way to trigger a lambda function only for the "initial" sync or when a certain dataset is created for the user?

Edit:
To be more specific: I do create the user via lambdas using the JS SDK. I use developer authentication with my own oauth2 flow. I don't know how to distinguish between a user granting access e.g. via Google the first time from someone doing this the second time. The json with the access code seams the same to me... Maybe I am mistaken.

Also using the getOpenIdTokenForDeveloperIdentity call I don't know how to distinguish between an ID that is new to cognito from one cognito already knows.

Edit 2: To be even more precise: I am building on this project: https://github.com/laardee/serverless-authentication-boilerplate/blob/master/authentication/lib/storage/usersStorage.js

here is how i do save the User to cognito at the moment. I do run this code for first time users as well as nth time users. My problem is that i dont know how to distinguish...

const saveCognito = (profile) => new Promise((resolve, reject) => {
  if (profile) {
    cognitoidentity.getOpenIdTokenForDeveloperIdentity({
      IdentityPoolId: process.env.COGNITO_IDENTITY_POOL_ID,
      Logins: {
        // profile.userId = encrypted id of the e.g. google oauth2 id
        [process.env.COGNITO_PROVIDER_NAME]: profile.userId 
      }
    }, (err, dat) => {
      if (err) {
        reject(err);
      } else {
        var list_params = {
          DatasetName: 'user-data', /* dataset name */
          IdentityId: dat.IdentityId, /* cognito id */
          IdentityPoolId: process.env.COGNITO_IDENTITY_POOL_ID
        };
        cognitosync.listRecords(list_params, function(err, data) {
          if (err) {
            reject(err); // an error occurred
          } else {

            var RecordPatches = //[Parts of the i want to write to the user]
            // SyncSessionToken is returned by the cognitosync.listRecords call
            list_params["SyncSessionToken"] = data.SyncSessionToken; 
            list_params["RecordPatches"] = RecordPatches;

            cognitosync.updateRecords(list_params, function(err, update_data) {
              if (err){
                reject(err);
              } else {
                resolve();
              }
            });
          }
        });
      }
    });
  } else {
    reject('Invalid profile');
  }
});

Answer 1

So this is something which is not currently supported in Cognito out of the box. You are correct in saying that the only built in Cognito Event that will trigger a Lambda Function is the "Sync Trigger" Event. This Sync event is fired every time that a Cognito IdentityId Synchronizes some of their data to the Cognito Sync cloud data store.

This event is unrelated to the creation of a new IdentityId by Cognito Federated Identity.

You could in theory:

• Run a list-identities call on the IdentityPool, before the user logs in.
• Login the user. Check whether the IdentityId which has been given to the user is present in the list you retrieved before they logged in. This would tell you whether or not the identity that they were given existed before this login.
• Based on this information you could make a decision whether or not to programatically call the Lambda Function from your application.

The setup of the above would be complex, as for security reasons you would need to maintain this service, server-side. The list-identities call requires AWS credentials to call. And I doubt you'd want to include permissions for that call in your IAM policy for unauthenticated users.

Aside from the above there is not much you can do at the moment. In order to do this, you would need to setup a DynamoDB table (or some similar low latency datastore) where you could maintain the state of the IdentityId list, and then query this service/store whenever you login a user to compare new logins to the pre-existing list.

If this is critical to your use case I would suggest heading over to AWS Support, and create a case where you can log this as a feature request.

https://aws.amazon.com/premiumsupport/