AWS IAM用户添加虚拟MFA时出现iam:ListMFADevices权限错误

创建IAM用户并配置了AWS官方推荐的MFA强制策略，要求仅在启用MFA时允许执行部分S3操作，但用户登录后尝试添加虚拟MFA时，收到以下错误：

User: arn:aws:iam::1234567890:user/users/user@example.com is not authorized to perform: iam:ListMFADevices on resource: user user@example.com because no identity-based policy allows the iam:ListMFADevices action

使用的策略如下：

{
    "Statement": [
        {
            "Action": [
                "iam:ListVirtualMFADevices",
                "iam:ListUsers"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "AllowListActions"
        },
        {
            "Action": "iam:ListMFADevices",
            "Effect": "Allow",
            "Resource": [
                "arn:aws:iam::*:user/${aws:username}",
                "arn:aws:iam::*:mfa/*"
            ],
            "Sid": "AllowIndividualUserToListOnlyTheirOwnMFA"
        },
        {
            "Action": [
                "iam:ResyncMFADevice",
                "iam:EnableMFADevice",
                "iam:DeleteVirtualMFADevice",
                "iam:CreateVirtualMFADevice"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:iam::*:user/${aws:username}",
                "arn:aws:iam::*:mfa/${aws:username}"
            ],
            "Sid": "AllowIndividualUserToManageTheirOwnMFA"
        },
        {
            "Action": "iam:DeactivateMFADevice",
            "Condition": {
                "Bool": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            },
            "Effect": "Allow",
            "Resource": [
                "arn:aws:iam::*:user/${aws:username}",
                "arn:aws:iam::*:mfa/${aws:username}"
            ],
            "Sid": "AllowIndividualUserToDeactivateOnlyTheirOwnMFAOnlyWhenUsingMFA"
        },
        {
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "false"
                }
            },
            "Effect": "Deny",
            "NotAction": [
                "iam:ResyncMFADevice",
                "iam:ListVirtualMFADevices",
                "iam:ListUsers",
                "iam:ListMFADevices",
                "iam:EnableMFADevice",
                "iam:CreateVirtualMFADevice"
            ],
            "Resource": "*",
            "Sid": "BlockMostAccessUnlessSignedInWithMFA"
        }
    ],
    "Version": "2012-10-17"
}

错误根源在于策略中使用的${aws:username}变量仅指代纯用户名部分（即user@example.com），但该用户的ARN包含路径前缀users/，完整ARN为arn:aws:iam::1234567890:user/users/user@example.com。策略中arn:aws:iam::*:user/${aws:username}的资源匹配规则无法覆盖带路径的用户ARN，导致IAM无法识别允许的资源范围。

将策略中所有针对用户自身的资源引用，从arn:aws:iam::*:user/${aws:username}替换为${aws:userarn}变量——该变量会自动填充当前用户的完整ARN（包含路径），确保资源匹配准确。

修改后的完整策略如下：

{
    "Statement": [
        {
            "Action": [
                "iam:ListVirtualMFADevices",
                "iam:ListUsers"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "AllowListActions"
        },
        {
            "Action": "iam:ListMFADevices",
            "Effect": "Allow",
            "Resource": [
                "${aws:userarn}",
                "arn:aws:iam::*:mfa/${aws:username}"
            ],
            "Sid": "AllowIndividualUserToListOnlyTheirOwnMFA"
        },
        {
            "Action": [
                "iam:ResyncMFADevice",
                "iam:EnableMFADevice",
                "iam:DeleteVirtualMFADevice",
                "iam:CreateVirtualMFADevice"
            ],
            "Effect": "Allow",
            "Resource": [
                "${aws:userarn}",
                "arn:aws:iam::*:mfa/${aws:username}"
            ],
            "Sid": "AllowIndividualUserToManageTheirOwnMFA"
        },
        {
            "Action": "iam:DeactivateMFADevice",
            "Condition": {
                "Bool": {
                    "aws:MultiFactorAuthPresent": "true"
                }
            },
            "Effect": "Allow",
            "Resource": [
                "${aws:userarn}",
                "arn:aws:iam::*:mfa/${aws:username}"
            ],
            "Sid": "AllowIndividualUserToDeactivateOnlyTheirOwnMFAOnlyWhenUsingMFA"
        },
        {
            "Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "false"
                }
            },
            "Effect": "Deny",
            "NotAction": [
                "iam:ResyncMFADevice",
                "iam:ListVirtualMFADevices",
                "iam:ListUsers",
                "iam:ListMFADevices",
                "iam:EnableMFADevice",
                "iam:CreateVirtualMFADevice"
            ],
            "Resource": "*",
            "Sid": "BlockMostAccessUnlessSignedInWithMFA"
        }
    ],
    "Version": "2012-10-17"
}

修改后重新为用户附加该策略，即可正常执行MFA相关操作。

内容的提问来源于stack exchange，提问作者nlndctr