AWS IAM policy that allows users to change their own password

aws-iam-allow-password-changes.json

{
  "Version":"2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:ChangePassword"],
      "Resource": "arn:aws:iam::<account-number>:user/${aws:username}"
    },
    {
      "Effect": "Allow",
      "Action": ["iam:GetAccountPasswordPolicy"],
      "Resource": "*"
    }
  ]
}