- Correct entry.

:summary: AWS IAM policy to allow users to change their own password and manage

          their own keys.

A common practice for me a new member joins the team or when someone forgets

his/ her AWS account password is to change the account password myself, send the

new password over a unsecure channel (email, Slack) but force the account to

change the password on first login. Also, I prefer to have users manage their

own keys to AWS themselves. But without the correct IAM policy users aren't able

to perform either action. Here's an IAM to allow both:

A common practice for me when a new member joins the team or when someone

forgets his/ her AWS account password is to change the account password myself,

send the new password over an unsecure channel (email, Slack) but force the

account to change the password on first login. Also, I prefer to have users

manage their own keys to AWS themselves. But without the correct IAM policy

users aren't able to perform either action. Here's an IAM to allow both:

.. code:: json