{"record":{"id":"7d16037722ad9a88","repo":"anomalyco/sst","slug":"you-must-provide-a-kms-key-via-kmskey-when-confi","errorCode":null,"errorMessage":"You must provide a KMS key via `kmsKey` when configuring `customEmailSender` or `customSmsSender`.","messagePattern":"You must provide a KMS key via `kmsKey` when configuring `customEmailSender` or `customSmsSender`\\.","errorType":"exception","errorClass":"VisibleError","httpStatus":null,"severity":"error","filePath":"platform/src/components/aws/cognito-user-pool.ts","lineNumber":644,"sourceCode":"\n    function normalizeAliasesAndUsernames() {\n      all([args.aliases, args.usernames]).apply(([aliases, usernames]) => {\n        if (aliases && usernames)\n          throw new VisibleError(\n            \"You cannot set both aliases and usernames. Learn more about customizing sign-in attributes at https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-attributes.html#user-pool-settings-aliases\",\n          );\n      });\n    }\n\n    function normalizeTriggers() {\n      if (!args.triggers) return;\n\n      return output(args.triggers).apply((triggers) => {\n        if (\n          (triggers.customEmailSender || triggers.customSmsSender) &&\n          !triggers.kmsKey\n        )\n          throw new VisibleError(\n            \"You must provide a KMS key via `kmsKey` when configuring `customEmailSender` or `customSmsSender`.\",\n          );\n\n        return {\n          ...triggers,\n          preTokenGenerationVersion:\n            triggers.preTokenGenerationVersion === \"v2\" ? \"V2_0\" : \"V1_0\",\n        };\n      });\n    }\n\n    function normalizeVerify() {\n      if (!args.verify) return;\n\n      return output(args.verify).apply((verify) => {\n        return {\n          defaultEmailOption: \"CONFIRM_WITH_CODE\",\n          emailMessage:","sourceCodeStart":626,"sourceCodeEnd":662,"githubUrl":"https://github.com/anomalyco/sst/blob/a0bd20f762883e72a35caccb4896c42ce5b3f707/platform/src/components/aws/cognito-user-pool.ts#L626-L662","documentation":"Cognito's customEmailSender and customSmsSender Lambda triggers encrypt the message code with a dedicated KMS key. AWS requires this key, so SST throws a VisibleError if either trigger is configured without args.triggers.kmsKey.","triggerScenarios":"new sst.aws.CognitoUserPool('X', { triggers: { customEmailSender: {...}, customSmsSender: {...} } }) with no kmsKey in triggers — checked in normalizeTriggers.","commonSituations":"Adding a custom sender function following a tutorial that omitted the KMS requirement; migrating from Lambda email config to custom senders and not creating a key.","solutions":["Create a KMS key and pass it via triggers.kmsKey.","Grant the Cognito service principal and the sender Lambda access to the key.","Or remove customEmailSender/customSmsSender and use Cognito's built-in email/SMS sending if custom encryption isn't needed."],"exampleFix":"// before\ntriggers: { customEmailSender: { function: senderFn } }\n// after\nconst key = new sst.aws.KmsKey('SenderKey');\ntriggers: { customEmailSender: { function: senderFn }, kmsKey: key }","handlingStrategy":"validation","validationCode":"function validateTriggers(triggers) {\n  if ((triggers?.customEmailSender || triggers?.customSmsSender) && !triggers?.kmsKey)\n    throw new Error('triggers.kmsKey is required with customEmailSender/customSmsSender');\n}\nvalidateTriggers(triggersConfig);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Provision a sst.aws.KmsKey next to any custom sender triggers.","Grant Cognito and the sender Lambda permissions on the key.","Remove custom senders if you only need built-in email/SMS delivery."],"tags":["aws","cognito","kms","lambda","missing-required-config"],"backgroundTag":"missing-required-config-property","analyzedSha":"a0bd20f762883e72a35caccb4896c42ce5b3f707","analyzedAt":"2026-08-30T11:26:00.383Z","schemaVersion":2},"datasetVersion":"2026-08-30T13:17:10.514Z"}