AWS IAM policy Credential Settings

Question

Based on my current users scenario ,I was thinking it would be useful to have an IAM policy that allowed 'ViewAccountPasswordRequirements' and 'ChangeOwnPassword'. I'm not sure why that wouldn't be the default behavior though in my AWS account.

Could anyone advice me how draft a policy on that, and advise on if we should/shouldn't allow all users to be able to reset their own passwords? Is this policy will work fine for my situation ?or do it require some changes on it? like MAF ?

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "ViewAccountPasswordRequirements",
            "Effect": "Allow",
            "Action": "iam:GetAccountPasswordPolicy",
            "Resource": "*"
        },
        {
            "Sid": "ChangeOwnPassword",
            "Effect": "Allow",
            "Action": [
                "iam:GetUser",
                "iam:ChangePassword"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}"
        }
    ]
}

Also could anyone please advise if there is a programmatic way to attach the new policy to all users?

Answer 1

Regarding your below question

Could advise me how to draft a policy on that, and advise on if we should/shouldn't allow all users to be able to reset their own passwords?

I don't think any negative point in doing so and if an organization has thousands of users then it's the best solution to give them this access to reduce tickets for tiny tasks. There is no drawback to this policy. In fact, if security matters then you can enable MFA as well so it forces the user to don't share their password with any other users because every time it will ask for multifactor authentication.

Also could anyone also please advise if there is a programmatic way to attach the new policy to all users?

Using console as well, you can do it quickly

• Go to "Policies"
• Open any policy
• Select the "Policy Usage" tab
• Click "Attach" and select all the users you want to give this policy access.

you can use BOTO3 python to play with the code to SCAN all the users and attach policy. I would suggest to use TAG for each user so that you can scan users based on that tag if possible.

https://hands-on.cloud/working-with-iam-in-python-using-boto3/#How-to-attaching-IAM-policy-to-the-user