Permitting IAM users to change their own passwords - AWS Identity and Access Management

Permitting IAM users to change their own passwords

You can grant IAM users the permission to change their own passwords for signing in to the AWS Management Console. You can do this in one of two ways:

Important

We recommend that you set a custom password policy that requires IAM users to create strong passwords.

To allow all IAM users change their own passwords

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, click Account settings.

  3. In the Password policy section, choose Change password policy if your account uses the default password policy. If your account uses a custom password policy, choose Change.

  4. Select Allow users to change their own password, and then click save changes.

  5. Provide users with the following instructions for changing their passwords: How an IAM user changes their own password.

For information about the AWS CLI, Tools for Windows PowerShell, and API commands that you can use to change the account's password policy (which includes letting all users change their own passwords), see Setting a password policy (AWS CLI).

To allow selected IAM users change their own passwords

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, click Account settings.

  3. In the Password policy section, make sure that Allow users to change their own password is not selected. If this check box is selected, all users can change their own passwords. (See the previous procedure.)

  4. Create the users who should be allowed to change their own password, if they do not already exist. For details, see Creating an IAM user in your AWS account.

  5. Create an IAM group for the users who should be allowed to change their passwords, and then add the users from the previous step to the group. For details, see Creating your first IAM admin user and user group and Managing IAM user groups.

    This step is optional, but it's a best practice to use groups to manage permissions. That way, you can add and remove users and change the permissions for the group as a whole.

  6. Assign the following policy to the group. For more information, see Managing IAM policies.

    { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iam:GetAccountPasswordPolicy", "Resource": "*" }, { "Effect": "Allow", "Action": "iam:ChangePassword", "Resource": "arn:aws:iam::account-id-without-hyphens:user/${aws:username}" } ] }

    This policy grants access to the ChangePassword action, which lets users change only their own passwords from the console, the AWS CLI, Tools for Windows PowerShell, or the API. It also grants access to the GetAccountPasswordPolicy action, which lets the user view the current password policy; this permission is required so that the user can view the account password policy on the Change password page. The user must be allowed to read the current password policy to ensure that the changed password meets the requirements of the policy.

  7. Provide users with the following instructions for changing their passwords: How an IAM user changes their own password.

For more information

For more information on managing credentials, see the following topics: