I followed this guide: https://repost.aws/knowledge-center/cognito-okta-oidc-identity-provider
One tricky note is the email is case-sensitive
email