According to my support representative and the documentation https://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-lambda-pre-token-generation.html#aws-lambda-triggers-pre-token-generation-example-version-2-overview, the response should return list types for groupsToOverride and iamRolesToOverride even when I use V2 pre token generation, not Map<String, String>. My experiences with Map<String, String> here is that cognito fails when I return an object generated by the current java sdk with map here instead of a list, so I suspect that the SDK uses the wrong types here. Thank you in advance for looking into my issue!