title: AWS IAM force MFA but allows change password the first time
body: <p>How do you force the use of MFA for AWS IAM users but allow them to change their password when they log in for the first time?</p>
  
  <p>If you follow <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-mfa-and-creds.html" rel="nofollow noreferrer">AWS Docs</a>, and force MFA, new users cannot change password when they first get their accounts.</p>
  
  <p>I know you can either <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_users-self-manage-mfa-and-creds.html" rel="nofollow noreferrer">force MFA</a> or <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_my-sec-creds-self-manage.html" rel="nofollow noreferrer">not</a> and allow users to manage their own password and credentials. Also, AWS has a way to work around the issue but it's not recommended:</p>
  
  <blockquote>
    <p>This example policy does not allow users to reset a password while
    signing in. New users and users with an expired password might try to
    do so. You can allow this by adding iam:ChangePassword to the
    statement DenyAllExceptListedIfNoMFA. However, IAM does not recommend
    this. Allowing users to change their password without MFA can be a
    security risk.</p>
  </blockquote>
  
  <p>So what's the "recommended" way?</p>
  
  <p>This question was also <a href="https://forums.aws.amazon.com/message.jspa?messageID=856250" rel="nofollow noreferrer">asked in AWS forum</a> without a real answer.</p>