self-manage-iam-credentials-and-mfa

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Create and assign an IAM Policy to an existing group to allow users to manage their own credentials and MFA.",
  "Parameters": {
      "Group": {
      "Description": "Assign the IAM policy to an existing group",
      "Type": "String"
    }
  },
  "Resources": {
    "SelfManageIAMPolicy": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "Groups" : [ { "Ref" : "Group" } ],
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "AllowUsersAllActionsForCredentials",
              "Effect": "Allow",
              "Action": [
                "iam:*LoginProfile",
                "iam:*AccessKey*",
                "iam:*SigningCertificate*"
              ],
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:iam::",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    ":user/${aws:username}"
                  ]
                ]
              }
            },
            {
              "Sid": "AllowUsersToCreateDeleteTheirOwnVirtualMFADevices",
              "Effect": "Allow",
              "Action": [
                "iam:*VirtualMFADevice"
              ],
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:iam::",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    ":mfa/${aws:username}"
                  ]
                ]
              }
            },
            {
              "Sid": "AllowUsersToEnableSyncDisableTheirOwnMFADevices",
              "Effect": "Allow",
              "Action": [
                "iam:DeactivateMFADevice",
                "iam:EnableMFADevice",
                "iam:ListMFADevices",
                "iam:ResyncMFADevice"
              ],
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:iam::",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    ":user/${aws:username}"
                  ]
                ]
              }
            },
            {
              "Sid": "AllowUsersToListVirtualMFADevices",
              "Effect": "Allow",
              "Action": [
                "iam:ListVirtualMFADevices"
              ],
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:iam::",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    ":mfa/*"
                  ]
                ]
              }
            },
            {
              "Sid": "AllowUsersToListUsersInConsole",
              "Effect": "Allow",
              "Action": [
                "iam:ListUsers"
              ],
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:iam::",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    ":user/*"
                  ]
                ]
              }
            }
          ]
        },
        "PolicyName": "SelfManageIAMPolicy"
      }
    }
  },
  "Outputs": {
    "SelfManageIAMPolicyName": {
      "Value": {
        "Ref": "SelfManageIAMPolicy"
      },
      "Description": "IAM Policy Name"
    }
  }
}