Re-enabling users are password change

[gford1000-aws]

Create a second cron scheduler (say runs every minute), and second lambda that removes users from blackhole group
Then this solution will only email once a day, will auto-unlock the user quickly once they make their password change, your lambda code is clearer and there is more clarity in the logs about what is happening.
Should be a marginal cost impact to run the lambda each minute, especially compared to manual unlocking.