How to Change Your Own AWS IAM Password

To change your own IAM password, sign in as the IAM user, open the account menu in the upper-right, choose Security credentials, and select Update password. Enter the current password and the new password. Your administrator must allow the iam:ChangePassword action.

Choose the right task: Admin resets another user’s password · IAM user changes their own password · Admin reset with AWS CLI

Use this procedure only when you sign in with an AWS account ID or alias, an IAM username, and an IAM password.

If you sign in through AWS IAM Identity Center, Okta, Microsoft Entra ID, Google Workspace, or another identity provider, change the password through that identity system. If you use the AWS account root user, follow the separate root-user recovery process.

Change your own IAM password in the AWS console

Sign in through the IAM user sign-in page for the correct AWS account.
In the upper-right navigation bar, choose your IAM username.
Choose Security credentials.
On AWS IAM credentials, find the console password and choose Update password.
Enter your current password.
Enter and confirm the new password.
Choose Update password.

The new password must satisfy the IAM account password policy. Your account administrator can also require a password change at next sign-in.

Change your own IAM password with AWS CLI

Use change-password, not update-login-profile:

aws iam change-password \
  --old-password 'CURRENT_PASSWORD' \
  --new-password 'NEW_PASSWORD'

This command changes the password for the IAM user associated with the credentials making the request. It does not accept a --user-name argument.

Be careful with shell history and process inspection. Entering passwords directly on a shared host, in CI, or in a recorded terminal can expose both values. The console flow is usually safer for a human-initiated change.

What permissions are required?

The IAM user needs iam:ChangePassword for their own user resource and may need iam:GetAccountPasswordPolicy to view the password requirements. AWS provides an example policy for allowing users to change only their own console password.

If the Update password control is missing or the CLI returns AccessDenied, ask the administrator to grant the narrow self-service permission. Do not request broad IAM administration rights.

Common errors

`AccessDenied`

The user is missing iam:ChangePassword, a permissions boundary or SCP blocks it, or the credentials do not belong to the IAM user you expected. Ask an administrator to inspect the complete authorization path.

Password policy violation

The new password may be too short, reuse a previous value, or fail the account’s character requirements. Review the displayed password policy and choose a new unique password.

The current password is unknown

Self-service change requires the current password. Ask an administrator to perform an IAM password reset and require a new password at next sign-in.

Confirm the account ID or alias, IAM username, sign-in URL, and MFA device. AWS accounts can have identical usernames, so a remembered sign-in page for another account can look like a bad-password failure.

After changing the password

Store the password in an approved password manager.
Do not reuse it on another service.
Confirm that MFA is enabled for the IAM user.
Report any suspected exposure so administrators can review sessions, access keys, and CloudTrail activity.
Prefer IAM Identity Center or federation for workforce access when your organization supports it.

Changing the password does not rotate access keys or terminate every programmatic credential. Those are separate credentials with separate incident-response steps.

Official AWS references

Published August 2026.