MFA必須のCognitoでDR対策を実装したい

import boto3
import json
import os
import random
import string

def lambda_handler(event, context):
    cognito_client = boto3.client('cognito-idp', region_name='ap-northeast-3')
    target_user_pool_id = os.environ['TARGET_USER_POOL_ID']
    
    # イベントからユーザー属性を取得
    user_attributes = event['request']['userAttributes']
    username = user_attributes.get('email')
    
    try:
        # 新しいユーザープールでユーザーを作成
        response = cognito_client.admin_create_user(
            UserPoolId=target_user_pool_id,
            Username=username,
            UserAttributes=[
                {'Name': 'phone_number', 'Value': user_attributes.get('phone_number', '')},
                {'Name': 'email', 'Value': username},
            ],
            TemporaryPassword=generate_random_password(),
            MessageAction='SUPPRESS'
        )
        
        print(f"User {username} created successfully in the target user pool. response: {response}")
                
        return event
    
    except Exception as e:
        print(f"Error creating user or setting MFA for {username} in the target user pool: {str(e)}")
        raise e

def generate_random_password():
    length = 20
    characters = string.ascii_letters + string.digits + string.punctuation
    password = ''.join(random.choice(characters) for i in range(length))
    
    # 本来は決してログにパスワードは残さないでください
    print(f"Password {password} is created successfully")

    return password

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "cognito-idp:AdminCreateUser",
            "Resource": "arn:aws:cognito-idp:ap-northeast-3:<アカウントID>:userpool/<ユーザープールID>"
        }
    ]
}

import boto3
import csv
import io
import os
from datetime import datetime

def lambda_handler(event, context):
    cognito_client = boto3.client('cognito-idp', region_name='ap-northeast-3')
    s3_client = boto3.client('s3')

    user_pool_id = os.environ['USER_POOL_ID']
    s3_bucket = os.environ['S3_BUCKET_NAME']

    # 全ユーザー情報を取得
    all_users = get_all_users(cognito_client, user_pool_id)

    # CSVファイルを作成
    csv_buffer = io.StringIO()
    csv_writer = csv.writer(csv_buffer)

    # ヘッダーを書き込む
    headers = [
        'profile', 'address', 'birthdate', 'gender', 'preferred_username', 
        'updated_at', 'website', 'picture', 'phone_number', 'phone_number_verified', 
        'zoneinfo', 'locale', 'email', 'email_verified', 'given_name', 'family_name', 
        'middle_name', 'name', 'nickname', 'cognito:mfa_enabled', 'cognito:username'
    ]
    csv_writer.writerow(headers)

    # ユーザー情報を書き込む
    for user in all_users:
        attributes = user.get('Attributes', '')
        email = get_attribute_value(attributes, 'email')

        row = [''] * len(headers)  # Initialize all fields with empty string
        row[8] = get_attribute_value(attributes, 'phone_number')
        row[12] = email
        row[13] = get_attribute_value(attributes, 'email_verified')
        row[19] = 'True'
        row[20] = email

        csv_writer.writerow(row)

    # S3にアップロード
    timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
    s3_key = f"{s3_bucket}_users_{timestamp}.csv"
    
    s3_client.put_object(
        Bucket=s3_bucket,
        Key=s3_key,
        Body=csv_buffer.getvalue(),
        ContentType='text/csv'
    )

    print(f"CSV file uploaded to s3://{s3_bucket}/{s3_key}")

    return event

def get_all_users(client, user_pool_id):
    users = []
    pagination_token = None

    while True:
        if pagination_token:
            response = client.list_users(
                UserPoolId=user_pool_id,
                PaginationToken=pagination_token
            )
        else:
            response = client.list_users(UserPoolId=user_pool_id)

        users.extend(response['Users'])

        pagination_token = response.get('PaginationToken')
        if not pagination_token:
            break

    return users

def get_attribute_value(attributes, name):
    return next((attr['Value'] for attr in attributes if attr['Name'] == name), None)

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": [
				"s3:PutObject",
				"cognito-idp:ListUsers"
			],
			"Resource": [
				"arn:aws:s3:::koma-cognito-rep-users/*",
				"arn:aws:cognito-idp:ap-northeast-3:<アカウントID>:userpool/<ユーザープールID>"
			]
		}
	]
}

[SKIPPED] Line Number 3 - The user already existed.