[AWS:Cognito] - [BUG] - Cannot create cfn user pool with only email MFA enabled

[khushail]

Name of the resource

AWS::Cognito::UserPool

Resource Name

AWS:COGNITO:USERPOOL

Issue Description

User is trying to create a Cognito user pool using the L1 construct and ONLY email MFA enabled leads to an error in CloudFormation.

This DOES work if I create the same user pool without any MFA enabled and then go to the AWS console and update it manually to have email only MFA.

Expected Behavior

CloudFormation is able to create the requested resource without issues.

Observed Behavior

Error received -

Resource handler returned message: "SMS configuration and Auto verification for phone_number are required when MFA is required/optional (Service: CognitoIdentityProvider, Status Code: 400, Request ID: ..., HandlerErrorCode: InvalidRequest)

Test Cases

Here is an example of a stack that yields the error in CloudFormation

import * as cognito from 'aws-cdk-lib/aws-cognito';
import { App, Stack, StackProps } from 'aws-cdk-lib/core';

export class AuthStack extends Stack {
  constructor(scope: App, id: string, props: StackProps) {
    super(scope, id, props);

    const userPool = new cognito.CfnUserPool(this, 'UserPool', {
      userPoolName: 'UserPool123',
      adminCreateUserConfig: {
        allowAdminCreateUserOnly: true,
        unusedAccountValidityDays: 1,
      },
      usernameAttributes: ['email'],
      usernameConfiguration: {
        caseSensitive: false,
      },
      enabledMfas: ['EMAIL_OTP'],
      mfaConfiguration: 'OPTIONAL',
    });
  }
}

user also tried giving EmailConfiguration in the docs but it still yields the same error

Other Details

Origiinal issue reported in CDK -aws/aws-cdk#32615
Previous issue ( not similar but linked) - aws/aws-cdk#11478