My password policy is configured to allow users to change their passwords, but when I create a new user with the "must change password" option, the user gets told they need "iam:ChangePassword" permission.

They get a similar message when they try to change it using the CLI.

Any idea how to diagnose and fix this?