title: AWS Cognito - Users lost "non-mutable" attribute "email_verified"
body: <p>After using Cognito for a few months, some users in a user pool have now lost the "email_verified" attribute. I can't understand how it is missing or how to recover.</p>
  
  <p>Symptoms are:</p>
  
  <ul>
  <li>Users can still login</li>
  <li>User password can not change (eg via <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/using-amazon-cognito-user-identity-pools-javascript-examples.html" rel="nofollow noreferrer">JS SDK - changePassword</a>), produces error: "x-amzn-errormessage: Cannot reset password for the user as there is no registered/verified email or phone_number"</li>
  <li><p>Getting the user attributes for the user with the <a href="https://docs.aws.amazon.com/cli/latest/reference/cognito-idp/list-users.html" rel="nofollow noreferrer">list-users CLI</a> shows the attribute is missing</p>
  
  <pre><code>aws cognito-idp list-users --user-pool-id MYID-123 --query 'Users[?Username==`error@bla.com`].[*]'
  [
    [
      [
          "error@bla.com", 
          true, 
          "CONFIRMED", 
          1522127817.526, 
          1522127819.369, 
          [
              {
                  "Name": "sub", 
                  "Value": "123123123341241238"
              }, 
              {
                  "Name": "email", 
                  "Value": "bla@bla.com"
              }
          ]
       ]
    ]
  ]
  </code></pre>
  
  <p>vs. one with the attribute in place</p>
  
  <pre><code>aws cognito-idp list-users --user-pool-id MYID-123 --query 'Users[?Username==`bla@bla.com`].[*]'
  [
    [
      [
          "bla@bla.com", 
          true, 
          "CONFIRMED", 
          1524048734.588, 
          1524048737.777, 
          [
              {
                  "Name": "sub", 
                  "Value": "1231231231231235"
              }, 
              {
                  "Name": "email_verified", 
                  "Value": "true"
              }, 
              {
                  "Name": "email", 
                  "Value": "bla@bla.com"
              }
          ]
        ]
     ]
   ]
  </code></pre></li>
  </ul>
  
  <p>If I try deleting the attribute (with enough permissions), it fails - as one would expect - explaining it is not mutable.</p>
  
  <pre><code>aws cognito-idp admin-delete-user-attributes --user-pool-id MYID-123 --username test2@test.com --user-attribute-names email_verified
  
  An error occurred (InvalidParameterException) when calling the AdminDeleteUserAttributes operation: Cannot modify the non-mutable attribute email_verified
  </code></pre>