IAM Policy to manage own credentials including MFA

gistfile1.json

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "AllowUsersAllActionsForCredentials",
			"Effect": "Allow",
			"Action": [
				"iam:ChangePassword",
				"iam:*LoginProfile",
				"iam:*SigningCertificate*",
				"iam:*AccessKey*"
			],
			"Resource": ["arn:aws:iam::<aws-account-id>:user/${aws:username}"]
		},
		{
			"Sid": "AllowUsersToSeeStatsOnIAMConsoleDashboard",
			"Effect": "Allow",
			"Action": [
				"iam:GetAccount*",
				"iam:ListAccount*"
			],
			"Resource": ["*"]
		},
		{
			"Sid": "AllowUsersToCreateDeleteTheirOwnMFADevices",
			"Effect": "Allow",
			"Action": [
				"iam:*VirtualMFADevice*",
				"iam:*MFADevice*"
			],
			"Resource": [
				"arn:aws:iam::<aws-account-id>:user/${aws:username}",
				"arn:aws:iam::<aws-account-id>:mfa/${aws:username}"
			]
		},
		{
			"Sid": "AllowUsersToListVirtualMFADevices",
			"Effect": "Allow",
			"Action": ["iam:ListVirtualMFADevices", "iam:ListMFADevices" ],
			"Resource": ["arn:aws:iam::<aws-account-id>:mfa/*"]
		},
		{
			"Sid": "AllowUsersToListUsersInConsole",
			"Effect": "Allow",
			"Action": ["iam:ListUsers"],
			"Resource": ["arn:aws:iam::<aws-account-id>:user/*"]
		}
	]
}