How to allow MFA self-management with custom MFA device names (multiple MFA)

With help from AWS support we changed our policy to allow people to self-manage (all) their MFA devices without any naming restrictions.

From:

        {
            "Action": [
                "iam:CreateVirtualMFADevice",
                "iam:DeleteVirtualMFADevice"
            ],
            "Resource": "arn:aws:iam::*:mfa/${aws:username}",
            "Effect": "Allow"
        },

To:

        {
            "Action": [
                "iam:CreateVirtualMFADevice",
                "iam:DeleteVirtualMFADevice"
            ],
            "Resource": "arn:aws:iam::*:mfa/*",
            "Effect": "Allow"
            "Condition": {
                "StringLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::*:user/${aws:username}"
                    ]
                }
            },
        },

The condition makes it so users can only change their own MFA devices no matter what the name is. Working so far.

We're going to update this policy example shortly - we apologize for any inconvenience. The policy example did not allow a customer to manage more than 1 MFA device for themselves because of the constraint on having the virtual MFA device being equal to the user name.

It's only possible to have a virtual MFA device associated with 1 user at a time. As an immediate workaround the resource can be removed from the statement allowing the creation of a virtual MFA device. In doing so for most customers it'd likely be adviseable to remove the DeleteVirtualMFADevice statement as to not allow someone to delete any unassigned MFA device that may be used later. Here's an example:

       {
            "Action": [
                "iam:CreateVirtualMFADevice"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },

Based on @GdeVos answer above, I think the final policy should be like below. I ran a couple of tests and it seems working fine.

Do you agree?

{
    "Version":"2012-10-17",
    "Statement":[
       {
          "Sid":"AllowViewAccountInfo",
          "Effect":"Allow",
          "Action":"iam:ListVirtualMFADevices",
          "Resource":"*"
       },
       {
          "Sid":"AllowManageOwnVirtualMFADevice",
          "Effect":"Allow",
          "Action":[
             "iam:CreateVirtualMFADevice",
             "iam:DeleteVirtualMFADevice"
          ],
          "Resource":"arn:aws:iam::*:mfa/*",
          "Condition":{
             "StringLike":{
                "aws:PrincipalArn":[
                   "arn:aws:iam::*:user/${aws:username}"
                ]
             }
          }
       },
       {
          "Sid":"AllowManageOwnUserMFA",
          "Effect":"Allow",
          "Action":[
             "iam:DeactivateMFADevice",
             "iam:EnableMFADevice",
             "iam:GetUser",
             "iam:ListMFADevices",
             "iam:ResyncMFADevice"
          ],
          "Resource":"arn:aws:iam::*:user/*",
          "Condition":{
             "StringLike":{
                "aws:PrincipalArn":[
                   "arn:aws:iam::*:user/${aws:username}"
                ]
             }
          }
       },
       {
          "Sid":"DenyAllExceptListedIfNoMFA",
          "Effect":"Deny",
          "NotAction":[
             "iam:CreateVirtualMFADevice",
             "iam:EnableMFADevice",
             "iam:GetUser",
             "iam:ListMFADevices",
             "iam:ListVirtualMFADevices",
             "iam:ResyncMFADevice",
             "sts:GetSessionToken"
          ],
          "Resource":"*",
          "Condition":{
             "BoolIfExists":{
                "aws:MultiFactorAuthPresent":"false"
             }
          }
       }
    ]
 }

In the meantime, since I think they don't have a proper solution now, I'm planning to use the following statement to allow MFA multiple devices self management to my users "${aws:username}*":

Of course, by using that I need to send them instructions to always use their username as part of MFA device name.

        {
            "Action": [
                "iam:CreateVirtualMFADevice",
                "iam:DeleteVirtualMFADevice"
            ],
            "Resource": "arn:aws:iam::*:mfa/${aws:username}*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "iam:DeactivateMFADevice",
                "iam:EnableMFADevice",
                "iam:GetUser",
                "iam:ListMFADevices",
                "iam:ResyncMFADevice"
            ],
            "Resource": "arn:aws:iam::*:user/${aws:username}*",
            "Effect": "Allow"
        

I have full admin access and I still can't add multiple MFA devices on my own account.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "", "Resource": "" } ] }

We are running into the same thing. When listing the MFA devices they are linked to a aws:username but we haven't found a way, if there is any, to use that in a policy to restrict it.

"MFADevices": [
        {
            "UserName": "a_username",
            "SerialNumber": "arn:aws:iam::<accountid>:mfa/<user-chosen-mfa-name>",
            "EnableDate": "2022-11-17...Z"
        },

It would have been a lot simpler if the name would be something like :mfa/<username>-<user-chosen-mfa-name> . :,-)

I have the same question since the suggested policy does not work properly anymore with multiple MFA devices capability: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage-mfa-only.html

am:DeactivateMFADevice does not work as well.