How to Reset an IAM User Password in AWS (Admin Guide)

To reset another IAM user’s password, open IAM → Users, select the user, open Security credentials, choose Manage console access, select Reset password, and require a password change at next sign-in when issuing a temporary password. This is an administrator action.

Choose the right task: Admin resets another user’s password · IAM user changes their own password · Admin reset with AWS CLI

Before you reset the password

This guide applies to an IAM user with AWS Management Console access. It does not apply to:

The AWS account root user
A workforce identity managed through AWS IAM Identity Center
A federated identity managed by an external identity provider
An access key used by software or the AWS CLI

Reset the credential in the system that owns the identity. If the person signs in through IAM Identity Center or an external identity provider, changing an IAM login profile will not change that password.

You need permission to view the user and update their login profile. Use an administrative role rather than the root user.

Reset an IAM user’s password in the AWS console

Sign in to the AWS Management Console with an authorized administrative role.
Open IAM.
In the navigation pane, choose Users.
Select the IAM user whose console password must be reset.
Open the Security credentials tab.
Under Console sign-in, choose Manage console access.
Select Reset password.
Choose an autogenerated password or enter a temporary custom password that satisfies the account password policy.
Select Require password change at next sign-in when the user should choose the final password.
For a suspected compromise, also select Revoke active console sessions.
Choose Reset password and deliver the temporary credential through an approved secure channel.

AWS does not let an administrator retrieve an existing IAM password. A reset replaces it.

Should I revoke active console sessions?

A password reset does not automatically prove that every existing session has stopped. Use Revoke active console sessions during account recovery, suspected compromise, employee offboarding, or any case where the old session must no longer be trusted.

Revocation works by attaching a time-bound deny policy to the user. Review and remove stale revocation policies after the incident or recovery process is complete.

Reset an IAM user’s password with AWS CLI

Use update-login-profile for an administrator-managed reset:

aws iam update-login-profile \
  --user-name IAM_USER_NAME \
  --password 'TEMPORARY_PASSWORD' \
  --password-reset-required

Avoid putting plaintext passwords in shell history, process lists, CI logs, or shared terminal transcripts. Prefer a secure interactive or secrets-delivery workflow when possible.

The detailed AWS CLI password reset guide covers the command and permissions. An IAM user changing their own password uses a different API: aws iam change-password.

Common problems

The user does not have console access

An IAM user can have programmatic credentials without a login profile. Confirm that console access is the intended authentication method before creating or changing a password.

The password does not satisfy the account policy

Review the IAM account password policy for length, character, reuse, and expiration rules. Do not weaken the organization-wide policy just to accept one temporary password.

The user signs in with IAM Identity Center

Reset the identity in IAM Identity Center or its connected identity source. The IAM Users page is not the credential authority for that person.

The user is locked out after the reset

Confirm the AWS account ID or alias, IAM username, sign-in URL, MFA requirements, and password-change-at-next-sign-in permission. A correct password cannot compensate for the wrong account sign-in page.

Password security guidance

Do not force arbitrary periodic password changes unless a governing policy requires them. Reset a password when it is compromised, forgotten, exposed, or administratively recovered. Prefer federation and short-lived credentials for workforce access, require MFA, and remove unused IAM users.

Kloudle evaluates cloud identity and access configuration as part of the broader self-hosted AWS posture. Password recovery remains an identity-administration process; a posture finding should lead to an owned, auditable change rather than an untracked credential reset.

Official AWS references

Updated August 2026.