User(s) can't change their passwords - can't find any deny's

The issue you're experiencing is likely related to permissions, but not necessarily due to an explicit deny. For IAM users to change their own passwords, they need specific permissions, and there might be a few things to check:

1. First, ensure that the policy you've created is actually attached to the user or group in question. Even with a well-crafted policy, if it's not attached to the user or their group, they won't have the necessary permissions.

2. Your policy looks mostly correct for allowing users to change their passwords. The "AllowManageOwnPasswords" section includes the necessary iam:ChangePassword permission.

3. You might also need to enable the account password policy to allow users to change their own passwords. This is a separate setting at the account level. You can update this using the AWS Management Console or by running the AWS CLI command:

aws iam update-account-password-policy

4. If you're using the AWS CLI to change passwords, especially with special characters, make sure you're using the change-password command correctly.

5. Check if there are any other policies attached to the user or their groups that might be conflicting with your permissions policy.

6. For users to change their passwords through the console, they may also need the iam:ListUsers permission to access their own user page. Consider adding this permission to your "AllowViewAccountInfo" statement.

7. If you want users to be able to change their password from their own user page (rather than just the Security Credentials page), ensure they have both iam:GetLoginProfile and iam:UpdateLoginProfile permissions, which you've already included.

If you've verified all these points and users still can't change their passwords, you might want to check if there are any Service Control Policies (SCPs) in AWS Organizations that could be restricting these actions.
Sources
Permit IAM users to change their own passwords - AWS Identity and Access Management
How do I change my password on the AWS Management Console | AWS re:Post
Resolve the IAM user password error "user is not authorized or password does not comply" | AWS re:Post
IAM: Allows IAM users to update their own credentials programmatically and in the console - AWS Identity and Access Management

Hello.

To change the password of an IAM user, use the ChangePassword API.
Therefore, at a minimum, your IAM policy must allow "iam:ChangePassword".
As described in the following document, to allow IAM users to change only their own passwords, you can set the following IAM policy to allow them to change their passwords.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_passwords_enable-user-change.html#proc_letselectuserschangepassword

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:GetAccountPasswordPolicy",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:ChangePassword",
      "Resource": "arn:aws:iam::*:user/${aws:username}"
    }
  ]
}

The policy that you have listed should allow users to reset their own passwords, since you already have "iam:GetAccountPasswordPolicy" and "iam:ChangePassword" listed.

Things to check next:

• Ensure the policy is actually attached to the users!
• Check CloudTrail logs (https://us-east-1.console.aws.amazon.com/cloudtrailv2/home?region=us-east-1#/events?ReadOnly=false) for ChangePassword events or other similar actions taken by the user. You can view the events to see what was allowed and what was denied, along with any error messages. It may be that some other action is getting denied, or the error message may tell you that there is an explicit deny somewhere. For example:
• If all still looks OK, check for explicit denies in the following places:
  • Other policies attached to the user/group
  • Organization SCPs
  • A Permissions Boundary attached to the user

Ok, so there is no Deny's and the only thing I did was run

aws iam update-account-password-policy

After that, the user was able to reset their password. The only question I have is when I visit the password policy page no longer shows what was there (15 characters, the checkbox's are all no longer there) BUT I am able to change!

I have same issue. And I solve it by set correct new password that match all pwd rules. My new password was without any non-alphanumeric character, and I always get error. After adding needed char I change my password successfully