AWS Cognito - User stuck in CONFIRMED and email_verified = false

You can change email_verified, phone_number_verified and other attributes by calling adminUpdateUserAttributes without any lambdas and triggers:

'use strict'

var AWS = require('aws-sdk')

AWS.config.update({
  accessKeyId: 'YOUR_ACCESS_KEY_HERE',
  secretAccessKey: 'YOUR_SECRET_ACCESS_KEY_HERE',
  region: 'us-east-1' // change region if required
});

var CognitoIdentityServiceProvider = AWS.CognitoIdentityServiceProvider

var client = new CognitoIdentityServiceProvider({
  apiVersion: '2016-04-19',
  region: 'us-east-1' // change region if required
})

client.adminUpdateUserAttributes({
  UserAttributes: [{
      Name: 'phone_number_verified',
      Value: 'true'
    }, {
      Name: 'email_verified',
      Value: 'true'
    }
    // other user attributes like phone_number or email themselves, etc
  ],
  UserPoolId: 'COGNITO_USER_POOL_ID_HERE',
  Username: 'USERNAME'
}, function(err) {
  if (err) {
    console.log(err, err.stack)
  } else {
    console.log('Success!')
  }
})

Using the AWS CLI you can update the email_verified attribute:

aws cognito-idp admin-update-user-attributes 
--user-pool-id eu-west-xxxxxx 
--username [email protected]
--user-attributes Name=email_verified,Value=true

Here is the official documentation: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cognito-idp/admin-update-user-attributes.html