A security engineer is analyzing an IAM policy that is attached to a group. The policy is intended to allow users to manage their own credentials. However, users are reporting that they cannot change their password. The policy is:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["iam:ChangePassword", "iam:GetAccountPasswordPolicy"],
"Resource": "*"
}
]
}
What is the issue?

Question

A security engineer is analyzing an IAM policy that is attached to a group. The policy is intended to allow users to manage their own credentials. However, users are reporting that they cannot change their password. The policy is: 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["iam:ChangePassword", "iam:GetAccountPasswordPolicy"],
      "Resource": "*"
    }
  ]
}
What is the issue?

Accepted Answer

The policy resource is set to "*", but ChangePassword requires the resource to be the specific user ARN.. The ChangePassword action requires the resource ARN to be the specific user's ARN (e.g., arn:aws:iam::account-id:user/${aws:username}). Using a wildcard '*' causes the policy to fail because IAM validates the resource ARN against the user's own ARN. Options A and C are incorrect because the required action is iam:ChangePassword, not UpdateLoginProfile or CreateLoginProfile. Option B is incorrect because the policy attachment to the group is not the issue; the resource restriction is the problem.

Answer

The policy does not include the iam:UpdateLoginProfile action.

Answer

The policy should be attached to the user instead of the group.

Answer

The policy is missing the iam:CreateLoginProfile action.

SCS-C02 Identity and Access Management Practice Question

Why each option matters

Option-by-option breakdown

Related to this question