(gen2-migration) `generate` command fails for optional MFA

[iliapolo]

How did you install the Amplify CLI?

No response

If applicable, what version of Node.js are you using?

No response

Amplify CLI Version

Local

What operating system are you using?

Mac

Did you make any manual changes to the cloud resources managed by Amplify? Please describe the changes made.

No

Describe the bug

npx amplify gen2-migration generate fails:

[2026-03-20T11:24:03.628Z] [generate] [aditbhas/dev] → Executing
[2026-03-20T11:24:03.952Z] [generate] [aditbhas/dev] • Fetching definitions from AWS for category: Auth
🛑 Execution failed: TypeError: Cannot read properties of undefined (reading 'PhysicalResourceId')

Expected behavior

Successful generation of Gen2 auth resource.

Reproduction steps

Configure auth like so:

Do you want to use the default authentication and security configuration? Manual configuration
 Select the authentication/authorization services that you want to use: User Sign-Up & Sign-In only (Best used with a cloud API only)
 Provide a friendly name for your resource that will be used to label this category in the project: (accept default value)
 Provide a name for your user pool: (accept default value)
 Warning: you will not be able to edit these selections. 
 How do you want users to be able to sign in? Username
 Do you want to add User Pool Groups? No
 Do you want to add an admin queries API? No
 Multifactor authentication (MFA) user login options: OPTIONAL (Individual users can use MFA)
 For user login, select the MFA types: SMS Text Message
 Specify an SMS authentication message: Your authentication code is {####}
 Email based user registration/forgot password: Enabled (Requires per-user email entry at registration)
 Specify an email verification subject: warningi
 Specify an email verification message: Your verification code is {####}
 Do you want to override the default password policy for this User Pool? Yes
 Enter the minimum password length for this User Pool: 8
 Select the password character requirements for your userpool: Requires Lowercase, Requires Uppercase, Requires Numbers, Requires Symbols
 Warning: you will not be able to edit these selections. 
 What attributes are required for signing up? Email
 Specify the app's refresh token expiration period (in days): 30
 Do you want to specify the user attributes this app can read and write? No
 Do you want to enable any of the following capabilities? 
 Do you want to use an OAuth flow? No
? Do you want to configure Lambda Triggers for Cognito? No

Project Identifier

No response

Log output

Details

# Put your logs below this line

Additional information

No response

Before submitting, please confirm:

• I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
• I have removed any sensitive information from my code snippets and submission.