Can I use AWS SNS Notify for SMS MFA with FusionAuth Generic Messenger?

[FASupportBot]

I want to enable SMS-based MFA in FusionAuth using AWS SNS Notify as the delivery mechanism. Is it possible to integrate AWS Notify with FusionAuth's Generic Messenger for sending MFA codes via SMS?

I'm aware that FusionAuth's Generic Messenger can POST to HTTP endpoints, but I'm not sure if it can directly integrate with AWS Notify's API requirements.

[FASupportBot]

Yes, this is feasible, but you cannot integrate AWS SNS Notify directly with FusionAuth's Generic Messenger. You'll need to implement a middleware relay to bridge the two systems.

Architecture

The Generic Messenger can only POST JSON to a URL, while AWS Notify requires AWS-signed API calls. The solution is to place a relay service between FusionAuth and AWS SNS.

Recommended approach:

1. Set up an AWS API Gateway endpoint backed by a Lambda function as your relay
2. Configure FusionAuth's Generic Messenger to POST to this API Gateway endpoint
3. The Lambda function receives the phone number and message from FusionAuth
4. The Lambda extracts the MFA code from the payload
5. The Lambda calls AWS SNS SendNotifyTextMessage with the code as a template variable
6. AWS SNS delivers the SMS using your pre-approved template

Important constraint

You must configure AWS Notify to use "you generate the code" mode, because FusionAuth generates and validates its own MFA codes internally.

Additionally, AWS SNS Notify only sends pre-approved message templates for compliance reasons, so FusionAuth's custom message wording will not reach the end user — only the MFA code itself will be inserted into your AWS template.