Skip to content

Instantly share code, notes, and snippets.

@joho

joho/iam-mfa-password-self-service-policy.json

Created May 6, 2021 01:22
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save joho/b3cc8cc7835f6fb271145a330a9eab4a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save joho/b3cc8cc7835f6fb271145a330a9eab4a to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. joho created this gist May 6, 2021.
    114 changes: 114 additions & 0 deletions iam-mfa-password-self-service-policy.json
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,114 @@
    {
    "Version": "2012-10-17",
    "Statement": [
    {
    "Sid": "AllowViewAccountInfo",
    "Effect": "Allow",
    "Action": [
    "iam:GetAccountPasswordPolicy",
    "iam:GetAccountSummary",
    "iam:ListUsers",
    "iam:ListVirtualMFADevices"
    ],
    "Resource": "*"
    },
    {
    "Sid": "AllowManageOwnPasswords",
    "Effect": "Allow",
    "Action": [
    "iam:ChangePassword",
    "iam:GetUser",
    "iam:CreateLoginProfile",
    "iam:DeleteLoginProfile",
    "iam:GetLoginProfile",
    "iam:UpdateLoginProfile"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnAccessKeys",
    "Effect": "Allow",
    "Action": [
    "iam:CreateAccessKey",
    "iam:DeleteAccessKey",
    "iam:ListAccessKeys",
    "iam:UpdateAccessKey"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnSigningCertificates",
    "Effect": "Allow",
    "Action": [
    "iam:DeleteSigningCertificate",
    "iam:ListSigningCertificates",
    "iam:UpdateSigningCertificate",
    "iam:UploadSigningCertificate"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnSSHPublicKeys",
    "Effect": "Allow",
    "Action": [
    "iam:DeleteSSHPublicKey",
    "iam:GetSSHPublicKey",
    "iam:ListSSHPublicKeys",
    "iam:UpdateSSHPublicKey",
    "iam:UploadSSHPublicKey"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnGitCredentials",
    "Effect": "Allow",
    "Action": [
    "iam:CreateServiceSpecificCredential",
    "iam:DeleteServiceSpecificCredential",
    "iam:ListServiceSpecificCredentials",
    "iam:ResetServiceSpecificCredential",
    "iam:UpdateServiceSpecificCredential"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnVirtualMFADevice",
    "Effect": "Allow",
    "Action": [
    "iam:CreateVirtualMFADevice",
    "iam:DeleteVirtualMFADevice"
    ],
    "Resource": "arn:aws:iam::*:mfa/${aws:username}"
    },
    {
    "Sid": "AllowManageOwnUserMFA",
    "Effect": "Allow",
    "Action": [
    "iam:DeactivateMFADevice",
    "iam:EnableMFADevice",
    "iam:ListMFADevices",
    "iam:ResyncMFADevice"
    ],
    "Resource": "arn:aws:iam::*:user/${aws:username}"
    },
    {
    "Sid": "DenyAllExceptListedIfNoMFA",
    "Effect": "Deny",
    "NotAction": [
    "iam:CreateVirtualMFADevice",
    "iam:EnableMFADevice",
    "iam:GetUser",
    "iam:ListMFADevices",
    "iam:ListVirtualMFADevices",
    "iam:ResyncMFADevice",
    "sts:GetSessionToken"
    ],
    "Resource": "*",
    "Condition": {
    "BoolIfExists": {
    "aws:MultiFactorAuthPresent": "false"
    }
    }
    }
    ]
    }