A common practice for me when a new member joins the team or when someone forgets his/ her AWS account password is to change the account password myself, send the new password over an insecure channel (email, Slack) but force the account to change the password on first login. Also, I prefer to have users manage their own keys to AWS themselves. But without the correct IAM policy users aren't able to perform either action. Here's an IAM to allow both:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GetAccountPasswordPolicy", "iam:ListAccount*", "iam:GetAccountSummary", "iam:GetAccountPasswordPolicy", "iam:ListUsers" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:ChangePassword", "iam:*LoginProfile", "iam:*AccessKey*", "iam:*SSHPublicKey*" ], "Resource": "arn:aws:iam::<INSERT AWS ACCOUNT ID HERE>:user/${aws:username}" } ] }
If you want a little script with the AWS CLI, here's one for you:
tempfile=$(mktemp) accountid="$(aws ec2 describe-security-groups \ --group-names 'Default' \ --query 'SecurityGroups[0].OwnerId' \ --output text)" curl https://www.shore.co.il/blog/static/policy.json | sed "s/<INSERT AWS ACCOUNT ID HERE>/$accountid/" > $tempfile aws iam create-policy \ --policy-name change-own-password \ --policy-document file://$tempfile rm $tempfile