Loading content/aws_change_own_password.rst 0 → 100644 +57 −0 Original line number Diff line number Diff line Self service AWS IAM policy ########################### :date: 2016-09-01 :summary: AWS IAM policy to allow users to change their own password and manage their own keys. A common practice for me a new member joins the team or when someone forgets his/ her AWS account password is to change the account password myself, send the new password over a unsecure channel (email, Slack) but force the account to change the password on first login. Also, I prefer to have users manage their own keys to AWS themselves. But without the correct IAM policy users aren't able to perform either action. Here's an IAM to allow both: .. code:: json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GetAccountPasswordPolicy", "iam:ListAccount*", "iam:GetAccountSummary", "iam:GetAccountPasswordPolicy", "iam:ListUsers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ChangePassword", "iam:*LoginProfile", "iam:*AccessKey*", "iam:*SSHPublicKey*" ], "Resource": "arn:aws:iam::<INSERT AWS ACCOUNT ID HERE>:user/${aws:username}" } ] } If you want a little script with the AWS CLI, here's one for you: .. code:: shell tempfile=$(mktemp) accountid="$(aws ec2 describe-security-groups \ --group-names 'Default' \ --query 'SecurityGroups[0].OwnerId' \ --output text)" curl https://www.shore.co.il/blog/static/policy.json | sed "s/<INSERT AWS ACCOUNT ID HERE>/$accountid/" > $tempfile aws iam create-policy \ --policy-name change-own-password \ --policy-document file://$tempfile rm $tempfile content/static/policy.json 0 → 100644 +26 −0 Original line number Diff line number Diff line { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GetAccountPasswordPolicy", "iam:ListAccount*", "iam:GetAccountSummary", "iam:GetAccountPasswordPolicy", "iam:ListUsers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ChangePassword", "iam:*LoginProfile", "iam:*AccessKey*", "iam:*SSHPublicKey*" ], "Resource": "arn:aws:iam::<INSERT AWS ACCOUNT ID HERE>:user/${aws:username}" } ] } Loading
content/aws_change_own_password.rst 0 → 100644 +57 −0 Original line number Diff line number Diff line Self service AWS IAM policy ########################### :date: 2016-09-01 :summary: AWS IAM policy to allow users to change their own password and manage their own keys. A common practice for me a new member joins the team or when someone forgets his/ her AWS account password is to change the account password myself, send the new password over a unsecure channel (email, Slack) but force the account to change the password on first login. Also, I prefer to have users manage their own keys to AWS themselves. But without the correct IAM policy users aren't able to perform either action. Here's an IAM to allow both: .. code:: json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GetAccountPasswordPolicy", "iam:ListAccount*", "iam:GetAccountSummary", "iam:GetAccountPasswordPolicy", "iam:ListUsers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ChangePassword", "iam:*LoginProfile", "iam:*AccessKey*", "iam:*SSHPublicKey*" ], "Resource": "arn:aws:iam::<INSERT AWS ACCOUNT ID HERE>:user/${aws:username}" } ] } If you want a little script with the AWS CLI, here's one for you: .. code:: shell tempfile=$(mktemp) accountid="$(aws ec2 describe-security-groups \ --group-names 'Default' \ --query 'SecurityGroups[0].OwnerId' \ --output text)" curl https://www.shore.co.il/blog/static/policy.json | sed "s/<INSERT AWS ACCOUNT ID HERE>/$accountid/" > $tempfile aws iam create-policy \ --policy-name change-own-password \ --policy-document file://$tempfile rm $tempfile
content/static/policy.json 0 → 100644 +26 −0 Original line number Diff line number Diff line { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GetAccountPasswordPolicy", "iam:ListAccount*", "iam:GetAccountSummary", "iam:GetAccountPasswordPolicy", "iam:ListUsers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ChangePassword", "iam:*LoginProfile", "iam:*AccessKey*", "iam:*SSHPublicKey*" ], "Resource": "arn:aws:iam::<INSERT AWS ACCOUNT ID HERE>:user/${aws:username}" } ] }
