Home / server / Questions / 557215
Accepted
dorian
Asked: 2013-11-26 03:09:05 +0800 CST

How can I give an AWS IAM user permissions to manage his own security credentials?

  • 772

Specifically, I want the user to be able to create/delete his own access keys ("Action": ["iam:*AccessKey*"]) in the AWS console, but without giving them a full user list view in the IAM dashboard.

The instructions listed in the AWS documentation here add "Action": "iam:ListUsers" for all users to the policy, which is what I'd like to avoid.

I tried using

{
  "Sid":"AllowUserToListHimselfInConsole",
  "Action": "iam:ListUsers",
  "Effect": "Allow",
  "Resource": "arn:aws:iam::593145159899:user/${aws:username}"
}

to allow the user to just list his own account, but it didn't work.

Is there a way to do what I aim for, or is the full user list a prerequisite to be able to change your own credentials in the console?

amazon-web-services

2 Answers

  1. Best Answer

    Is there a way to do what I aim for, or is the full user list a prerequisite to be able to change your own credentials in the console?

    I'm afraid the latter is the case, at least that has been my experience as well so far, see e.g. my related answer to IAM access to EC2 REST API?, where I explore 'IAM Credentials Self Management' - interestingly the Official Solution to Allow a user to manage his or her own security credentials quoted from the AWS documentation just two weeks ago has vanished there, which 'correlates' with my qualification (i.e. they might have realized this being only applicable via custom solutions using the API and thus confusing):

    Please note that this solution still has usability flaws depending on how AWS resources are accessed by your users, i.e. via API, CLI, or the AWS Management Console (the latter requires additional permissions for example).

    Accordingly, my Extended Variation includes iam:ListUsers as well to gain a usable result. This is really unfortunate, because granting meanwhile fine grained access to AWS resources via the AWS Management Console is by far the easiest and most instructive way to empower new AWS users to explore on their own.

    • 4
    • 0