AWS Identity and Access Management
User Guide

IAM: Allows IAM Users to Self-Manage an MFA Device

This example shows how you might create a policy that allows IAM users to self-manage an MFA device. This policy grants the permissions necessary to complete this action from the AWS API or AWS CLI only.


If you add these permissions for a user that is signed in to AWS, they might need to sign out and back in to see these changes.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:CreateVirtualMFADevice", "iam:EnableMFADevice", "iam:ResyncMFADevice", "iam:DeleteVirtualMFADevice" ], "Resource": [ "arn:aws:iam::*:mfa/${aws:username}", "arn:aws:iam::*:user/${aws:username}", "arn:aws:iam::*:u2f/${aws:username}" ] }, { "Sid": "AllowUsersToDeactivateTheirOwnMFADevice", "Effect": "Allow", "Action": ["iam:DeactivateMFADevice"], "Resource": [ "arn:aws:iam::*:mfa/${aws:username}", "arn:aws:iam::*:user/${aws:username}", "arn:aws:iam::*:u2f/${aws:username}" ], "Condition": { "Bool": {"aws:MultiFactorAuthPresent": "true"} } }, { "Effect": "Allow", "Action": [ "iam:ListMFADevices", "iam:ListVirtualMFADevices", "iam:ListUsers" ], "Resource": "*" } ] }