Menu
AWS Identity and Access Management
User Guide

IAM: Allows IAM Users to Self-Manage an MFA Device

This example shows how you might create a policy that allows IAM users to self-manage an MFA device.

Note

If you add these permissions for a user that is signed in to AWS, they might need to sign out and back in to see these changes.

Copy
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:CreateVirtualMFADevice", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteVirtualMFADevice" ], "Resource": [ "arn:aws:iam::*:mfa/${aws:username}", "arn:aws:iam::*:user/${aws:username}" ] }, { "Sid": "AllowUsersToDeactivateTheirOwnVirtualMFADevice", "Effect": "Allow", "Action": [ "iam:DeactivateMFADevice" ], "Resource": [ "arn:aws:iam::*:mfa/${aws:username}", "arn:aws:iam::*:user/${aws:username}" ], "Condition": { "Bool": { "aws:MultiFactorAuthPresent": true } } }, { "Effect": "Allow", "Action": [ "iam:ListMFADevices", "iam:ListVirtualMFADevices", "iam:ListUsers" ], "Resource": "*" } ] }