0

I have several AWS IAM users, and I want to enable them to manage their own virtual MFA devices. Most of our IAM users don't have a Path attribute, so this statement works well enough:

{
    "Sid": "ManageOwnTOTPVirtualMFA",
    "Effect": "Allow",
    "Action": [
        "iam:ListVirtualMFADevices",
        "iam:EnableMFADevice",
        "iam:DeleteVirtualMFADevice",
        "iam:CreateVirtualMFADevice"
    ],
    "Resource": [
        "arn:aws:iam::123412341234:user/${aws:username}",
        "arn:aws:iam::123412341234:mfa/${aws:username}"
    ]
}

However, this does not work for users that have a Path attribute because the aws:username variable only includes the last part of the path.

Is there any way to grant IAM users with a Path prefix the ability to modify their own virtual MFA devices without needing to write a distinct IAM policy for every possible Path prefix?

1
  • Today I learned that AWS IAM does not allow the creation of two users with the same username, regardless of whether they have the same Path or not. That means it's impossible to have same-named users in different paths, which helps a lot. – Nic Dec 1 '20 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.