IAM policy where: Users must create new password at sign-in AND can use MFA?

Hi Emmab5,

I suggest you read these articles:

• https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage.html.
• https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage-mfa-only.html

In particular, you could leverage iam:ChangePassword and MultiFactorAuthPresent condition to achieve change password with mfa enabled.

Hope it helps

The IAM best practices have been updated. As a best practice, require human users to use federation with an identity provider to access AWS using temporary credentials.

IAM users are to be used only in very limited scenarios where an IAM role cannot be assumed. To learn about using AWS IAM Identity Center (successor to AWS Single Sign-On) to create users with temporary credentials, see Getting started in the AWS IAM Identity Center (successor to AWS Single Sign-On) User Guide.

In a nutshell, turn on AWS Organisations, then set up AWS IAM Identity Center. AWS IAM best practice is to configure federated users and this way, AWS helps you securely manage the administration of user passwords and MFA according to your preferences.