What permissions to give users to manage their own MFA devices

Question

I have IAM users and I want them to manage their own MFA devices. Create them, list them and remove them. They may choose any name they'd like to identify the MFA devices.

I used to have a permission like this:

```
      {
        Action = [
          "iam:ListMFADevices"
        ],
        Resource = [
          "arn:aws:iam::*:mfa/$${aws:username}",
          "arn:aws:iam::*:user/$${aws:username}"
        ],
        Effect = "Allow"
      },
      {
        Action = [
          "iam:CreateVirtualMFADevice",
          "iam:DeleteVirtualMFADevice",
          "iam:EnableMFADevice",
          "iam:ResyncMFADevice"
        ],
        Resource = [
          "arn:aws:iam::*:mfa/$${aws:username}",
          "arn:aws:iam::*:user/$${aws:username}"
        ],
        Effect = "Allow"
      },
```

But it seems that in this case the MFA device MUST be named the same as the AWS username. And that is not what I want.

So my question is: what if I change
`"arn:aws:iam::*:mfa/$${aws:username}",`
to
`"arn:aws:iam::*:mfa/*",`
(and keep the rest the same), can this user then manage MFA devices for all users? Or just for his own account? I can't really find a clear answer on how this should work.

kranthi putti · Answer

hello,
Here's a more concise version of the policy that allows IAM users to manage their own MFA devices:

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:ListMFADevices",
        "iam:ListVirtualMFADevices"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:CreateVirtualMFADevice",
        "iam:DeleteVirtualMFADevice"
      ],
      "Resource": "arn:aws:iam::${aws:accountId}:mfa/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:EnableMFADevice",
        "iam:ResyncMFADevice",
        "iam:DeactivateMFADevice",
        "iam:DeleteVirtualMFADevice"
      ],
      "Resource": "arn:aws:iam::${aws:accountId}:user/${aws:username}"
    }
  ]
}

```

1.List MFA Devices: Allows listing of all MFA devices.

```
{
  "Effect": "Allow",
  "Action": [
    "iam:ListMFADevices",
    "iam:ListVirtualMFADevices"
  ],
  "Resource": "*"
}

```
3.Manage Own MFA Device: Allows enabling, resyncing, deactivating, and deleting the virtual MFA device for the user's own account.

```
{
  "Effect": "Allow",
  "Action": [
    "iam:EnableMFADevice",
    "iam:ResyncMFADevice",
    "iam:DeactivateMFADevice",
    "iam:DeleteVirtualMFADevice"
  ],
  "Resource": "arn:aws:iam::${aws:accountId}:user/${aws:username}"
}

```
This policy allows IAM users to fully manage their own MFA devices without impacting other users' MFA devices. i hope this will resolve your issue.

Adeleke Adebowale Julius · Answer

If you change the resource ARN from "arn:aws:iam::*:mfa/$${aws:username}" to "arn:aws:iam::*:mfa/*", the IAM user will have permissions to manage MFA devices for all users within the AWS account.

****Here's how the updated policy will work:

"arn:aws:iam::*:mfa/*": This resource ARN pattern represents all MFA devices in the AWS account, regardless of the user they are associated with. By using this wildcard (*), the IAM user will have permissions to manage MFA devices for all users in the account.

"arn:aws:iam::*:user/$${aws:username}": This resource ARN pattern specifies the IAM user itself, allowing the user to manage their own MFA device.

With this policy configuration, the IAM user will be able to:

Manage their own MFA device (due to the "arn:aws:iam::*:user/$${aws:username}" resource ARN).

Manage MFA devices for all users in the AWS account (due to the "arn:aws:iam::*:mfa/*" resource ARN).

This might helps too :- https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-mfa-and-creds.html

https://medium.com/@debolek4dem/risks-of-broad-permissions-for-creating-mfa-devices-c7ab3d7b93f3

Mahaboob Basha · Answer

Hello,

To give the permission to a user to access and modify their own MFA devices create a policy with below Json code and attach that policy to user or group, so they can access it.

`{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:ListMFADevices",
                "iam:ListVirtualMFADevices",
                "iam:CreateVirtualMFADevice",
                "iam:EnableMFADevice",
                "iam:DeactivateMFADevice",
                "iam:DeleteVirtualMFADevice"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:ResyncMFADevice"
            ],
            "Resource": "arn:aws:iam::*:mfa/${aws:username}"
        }
    ]
}
`

What permissions to give users to manage their own MFA devices

Relevant content