A company uses Amazon Cognito user pools for authentication and has enabled multi-factor authentication (MFA). The company wants to send an email alert each time a user successfully logs in. What is the MOST operationally efficient way to implement this requirement?

The most operationally efficient way is to use an Amazon Cognito post-authentication Lambda trigger. This trigger fires automatically after a user successfully authenticates (including MFA) and is designed for custom logic like sending notifications. It directly integrates with the Cognito authentication flow, ensuring the email is sent reliably and immediately after a successful login. The other options are less efficient or appropriate: Calling an API Gateway endpoint from the client after login confirmation introduces client-side dependencies and potential vulnerabilities, as the client could fail to call the API or a malicious client could bypass it. Using a CloudWatch Logs subscription filter to watch login events is reactive and introduces latency, as it depends on logs being published and processed. It's also less direct than a dedicated trigger. Streaming Cognito logs to Kinesis Data Firehose and then processing with Lambda adds unnecessary complexity and latency for a simple post-login action. This approach is better suited for complex analytics or long-term storage of logs.