Question

A company has thousands of IAM users who each need to manage only their own credentials (access keys, MFA devices, and passwords) without being able to touch any other user's credentials. The security team wants a single reusable managed policy attached to all users rather than per-user policies. Which policy construct allows one policy to scope actions to only the calling user's own IAM resources?

Accepted Answer

Use the policy variable ${aws:username} in the Resource ARN so each user's actions apply only to their own IAM user resource.

Answer

Attach a permissions boundary referencing each user's principal ID to restrict access to their own credentials.

Answer

Create a resource-based policy on each IAM user that grants only that user access to their own credentials.

Answer

Add a condition key aws:PrincipalTag/username that matches the resource tag on each IAM user.