{"record":{"id":"da9d45350b2501c1","repo":"serverless/serverless","slug":"cognito-kms-key-id-not-same-for-single-user-pool","errorCode":"COGNITO_KMS_KEY_ID_NOT_SAME_FOR_SINGLE_USER_POOL","errorMessage":"Only one KMS Key for can be configured per Cognito User Pool. Affected Cognito User Pool: \"${currentPoolName}\".","messagePattern":"Only one KMS Key for can be configured per Cognito User Pool\\. Affected Cognito User Pool: \"(.+?)\"\\.","errorType":"exception","errorClass":"ServerlessError","httpStatus":null,"severity":"error","filePath":"packages/serverless/lib/plugins/aws/package/compile/events/cognito-user-pool.js","lineNumber":392,"sourceCode":"    return null\n  }\n\n  checkKmsArn(kmsKeyId, poolKmsIdMap, currentPoolName) {\n    // KMSKeyId is only used (and is required) with Custom Sender Sources\n    if (!kmsKeyId) {\n      throw new ServerlessError(\n        `KMS Key must be set when using a Custom Sender Source Trigger (CustomSMSSender and/or CustomEmailSender). Affected Cognito User Pool: \"${currentPoolName}\".`,\n        'COGNITO_KMS_KEY_NOT_SET',\n      )\n    }\n\n    const previousKmsId = poolKmsIdMap.get(currentPoolName)\n    if (\n      previousKmsId !== undefined &&\n      previousKmsId !== kmsKeyId &&\n      JSON.stringify(previousKmsId) !== JSON.stringify(kmsKeyId)\n    ) {\n      throw new ServerlessError(\n        `Only one KMS Key for can be configured per Cognito User Pool. Affected Cognito User Pool: \"${currentPoolName}\".`,\n        'COGNITO_KMS_KEY_ID_NOT_SAME_FOR_SINGLE_USER_POOL',\n      )\n    }\n    poolKmsIdMap.set(currentPoolName, kmsKeyId)\n  }\n\n  findUserPoolsAndFunctions() {\n    const userPools = []\n    const cognitoUserPoolTriggerFunctions = []\n\n    // Iterate through all functions declared in `serverless.yml`\n    this.serverless.service.getAllFunctions().forEach((functionName) => {\n      const functionObj = this.serverless.service.getFunction(functionName)\n\n      if (functionObj.events) {\n        functionObj.events.forEach((event) => {\n          if (event.cognitoUserPool) {","sourceCodeStart":374,"sourceCodeEnd":410,"githubUrl":"https://github.com/serverless/serverless/blob/b9d7ea51c8cce57cff1207964b9b71123673081f/packages/serverless/lib/plugins/aws/package/compile/events/cognito-user-pool.js#L374-L410","documentation":"A single Cognito user pool can only be associated with one KMS key. If two triggers for the same pool specify different kmsKeyId values, checkKmsArn rejects the mismatch.","triggerScenarios":"poolKmsIdMap.get(currentPoolName) returns a previously seen key; if it differs from the new kmsKeyId (by value or JSON) the throw fires.","commonSituations":"Two custom-sender triggers on one pool pointing at different KMS keys; updating the key on only some triggers during a rotation; copy-paste from another pool's config.","solutions":["Use the same kmsKeyId for every trigger on a given pool.","During key rotation, update all triggers for that pool together.","Centralize the kmsKeyId in a custom variable so all triggers reference one source."],"exampleFix":"# before\n- cognitoUserPool: { pool: MyPool, trigger: CustomSMSSender,  kmsKeyId: arn:.../key/aaa }\n- cognitoUserPool: { pool: MyPool, trigger: CustomEmailSender, kmsKeyId: arn:.../key/bbb }\n# after\n- cognitoUserPool: { pool: MyPool, trigger: CustomSMSSender,  kmsKeyId: arn:.../key/aaa }\n- cognitoUserPool: { pool: MyPool, trigger: CustomEmailSender, kmsKeyId: arn:.../key/aaa }","handlingStrategy":"validation","validationCode":"function inconsistentKmsPerPool(service) {\n  const map = {};\n  for (const e of allCognitoEvents(service)) {\n    if (!e.kmsKeyId) continue;\n    if (map[e.pool] && map[e.pool] !== e.kmsKeyId) return e.pool;\n    map[e.pool] = e.kmsKeyId;\n  }\n  return null;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use one kmsKeyId variable per pool.","Update all triggers together during key rotation."],"tags":["aws","cognito","kms","configuration","validation"],"backgroundTag":null,"analyzedSha":"b9d7ea51c8cce57cff1207964b9b71123673081f","analyzedAt":"2026-08-13T04:14:40.386Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}