Cognito client confirm_device is not working with MFA set to optional

[doino-gretchenliev]

Describe the bug

I'm using confirm_device to enable trust device. When MFA enforcement is set to Require MFA on the user pool, the confirm_device is successful. When it's set to optional the confirm_device returns:
An error occurred (InvalidParameterException) when calling the ConfirmDevice operation: Invalid device key given.the

Expected Behavior

No matter the MFA Enforcement the function should succeed.

Current Behavior

With the same arguments - valid access key and device key from NewDeviceMetadata the confirm_device function is failing with:
An error occurred (InvalidParameterException) when calling the ConfirmDevice operation: Invalid device key given.

Reproduction Steps

1. Set MFA Enforcment to optional on the Cognito user pool.
2. Perform successful auth with initiate_auth or admin_initiate_auth using USER_SRP_AUTH flow.
3. Use the auth response to execute confirm_device.

Possible Solution

No response

Additional Information/Context

No response

SDK version used

1.34.53

Environment details (OS name and version, etc.)

MacOs 14.4 (23E214)

[tim-finnigan]

Thanks for reporting this issue and your patience here. Running the confirm_device command involves a call to the underlying ConfirmDevice API. So any issues involving the API would likely need to get escalated to the Cognito service team.

The only other report I could find of that specific error was here where someone provided an answer that may be helpful. Can you confirm? Also the latest Boto3 version is 1.34.103 per the CHANGELOG, it may be worth updating to rule out any issue with older versions.

Could you provide a code snippet for reproducing the issue and debug logs (with any sensitive info redacted) by adding boto3.set_stream_info('') to your script? Once we have more info we can confirm whether or not this should be escalated to the Cognito service team.