You might want to use AdminGetUser instead. https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminGetUser.html passing user "sub". I remember using Admin prefixed methods on the API part.