How can I attach an IAM managed policy to an IAM role in CloudFormation?

5 minute read

I want to add an existing or new AWS Identity and Access Management (IAM) managed policy to a new or existing IAM role in AWS CloudFormation.

Short description

To add an existing or new IAM managed policy to a new IAM role resource, use the ManagedPolicyArns property of resource type AWS::IAM::Role. To add a new IAM managed policy to an existing IAM role resource, use the Roles property of resource type AWS::IAM::ManagedPolicy.

Your IAM managed policy can be an AWS managed policy or a customer managed policy.

Important: You can attach a maximum of 20 managed policies to an IAM role or user. The size of each managed policy can't exceed 6,144 characters. IAM doesn't count white space when calculating the size of a policy against this limit. For more information, see IAM and STS quotas.

Based on your scenario, complete the steps in one of the following sections:

Add an existing IAM managed policy to a new IAM role
Add a new IAM managed policy to a new IAM role
Add a new IAM managed policy to an existing IAM role

Resolution

Add an existing IAM managed policy to a new IAM role

Complete the following steps:

In your AWS CloudFormation template, create one or more parameters that you can pass in the Amazon Resource Name (ARN) of your IAM managed policy. See the following JSON and YAML examples.

JSON:

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "awsExampleManagedPolicyParameterOne": {
      "Type": "String",
      "Description": "ARN of the first IAM Managed Policy to add to the role"
    },
    "awsExampleManagedPolicyParameterTwo": {
      "Type": "String",
      "Description": "ARN of the second IAM Managed Policy to add to the role"
    }
  }
}

YAML:

Parameters:
  awsExampleManagedPolicyParameterOne:
    Type: String
    Description: 'ARN of the first IAM Managed Policy to add to the role'
  awsExampleManagedPolicyParameterTwo:
    Type: String
    Description: 'ARN of the second IAM Managed Policy to add to the role'

In the Resources section of your template, for the resource of type AWS::IAM::Role, set Ref to the parameters that you created in step 1. For this example, these are the awsExampleManagedPolicyParameterOne and awsExampleManagedPolicyParameterTwo parameters. See the following JSON and YAML examples.

JSON:

{
  "Resources": {
    "RootRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "ec2.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/",
        "ManagedPolicyArns": [
          {
            "Ref": "awsExampleManagedPolicyParameterOne"
          },
          {
            "Ref": "awsExampleManagedPolicyParameterTwo"
          }
        ]
      }
    }
  }
}

YAML:

Resources:
  RootRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - !Ref awsExampleManagedPolicyParameterOne
        - !Ref awsExampleManagedPolicyParameterTwo

To apply your existing IAM managed policy to your new IAM role, create or update the stack with your modified CloudFormation template.

Add a new IAM managed policy to a new IAM role

Complete the following steps:

In your AWS CloudFormation template, create a new policy using the AWS::IAM::ManagedPolicy resource. See the following JSON and YAML examples.

JSON:

{
  "SampleManagedPolicy": {
    "Type": "AWS::IAM::ManagedPolicy",
    "Properties": {
      "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "AllowAllUsersToListAccounts",
            "Effect": "Allow",
            "Action": [
              "iam:ListAccountAliases",
              "iam:ListUsers",
              "iam:GetAccountSummary"
            ],
            "Resource": "*"
          }
        ]
      }
    }
  }
}

YAML:

SampleManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          -
            Sid: AllowAllUsersToListAccounts
            Effect: Allow
            Action:
              - iam:ListAccountAliases
              - iam:ListUsers
              - iam:GetAccountSummary
            Resource: "*"

Use the !Ref logical ID syntax to attach the IAM managed policy resource to the AWS::IAM::Role resource.

For example, set Ref to the resource logical ID that you created in step 1 (SampleManagedPolicy). See the following JSON and YAML examples.

JSON:

{
  "RootRole": {
    "Type": "AWS::IAM::Role",
    "Properties": {
      "AssumeRolePolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "ec2.amazonaws.com"
              ]
            },
            "Action": [
              "sts:AssumeRole"
            ]
          }
        ]
      },
      "Path": "/",
      "ManagedPolicyArns": [
        {
          "Ref": "SampleManagedPolicy"
        }
      ]
    }
  }
}

YAML:

RootRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - !Ref SampleManagedPolicy

To apply your new IAM managed policy to your new IAM role, create or update the stack with your modified CloudFormation template.

Add a new IAM managed policy to an existing IAM role

Complete the following steps:

In your AWS CloudFormation template, create a parameter that you can use to pass in the name of your existing roles. See the following JSON and YAML examples.

JSON:

{
  "Parameters": {
    "awsExampleRolesParameter": {
      "Type": "CommaDelimitedList",
      "Description": "Names of existing Roles you want to add to the newly created Managed Policy"
    }
  }
}

YAML:

Parameters:
  awsExampleRolesParameter:
    Type: CommaDelimitedList
    Description: Names of existing Roles you want to add to the newly created Managed Policy

In the Resources section of your template, set Ref to the parameter that you created in step 1 (awsExampleRolesParameter) in the resource type AWS::IAM::ManagedPolicy. See the following JSON and YAML examples.

JSON:

{
  "Resources": {
    "SampleManagedPolicy": {
      "Type": "AWS::IAM::ManagedPolicy",
      "Properties": {
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "AllowAllUsersToListAccounts",
              "Effect": "Allow",
              "Action": [
                "iam:ListAccountAliases",
                "iam:ListUsers",
                "iam:GetAccountSummary"
              ],
              "Resource": "*"
            }
          ]
        },
        "Roles": {
          "Ref": "awsExampleRolesParameter"
        }
      }
    }
  }
}

YAML:

Resources:
  SampleManagedPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowAllUsersToListAccounts
            Effect: Allow
            Action:
              - iam:ListAccountAliases
              - iam:ListUsers
              - iam:GetAccountSummary
            Resource: '*'
      Roles: !Ref awsExampleRolesParameter

To apply your new IAM managed policy to your existing IAM role, create or update the stack with your modified CloudFormation template.

Topics

Management & Governance

Relevant content

IAM role attached Policy update
Accepted Answer
layansp
asked 10 months ago
IAM ODIC attaching existing role
Owais
asked 6 months ago
Can CloudFormation add existing policy to existing role?
Accepted Answer
MODERATOR
AWS-User-4245468
asked 4 years ago
Attach an existing policy to an existing role in CloudFormation
Accepted Answer
EXPERT
Alex_T
asked 4 years ago
How do I add an IP source condition to AWS managed policy in IAM User or Role
Accepted Answer
NattyWiz
asked 4 months ago
How can I resolve issues with switching IAM roles using the AWS Management Console?
AWS OFFICIALUpdated a year ago
How can I use IAM roles to restrict API calls from specific IP addresses to the AWS Management Console?
AWS OFFICIALUpdated 2 years ago
I created or updated an IAM policy and received the error "Has prohibited field Principal". How can I resolve this?
AWS OFFICIALUpdated 3 years ago
How can I restrict access to a specific IAM role session using an IAM identity-based policy?
AWS OFFICIALUpdated 3 years ago
Understanding AWS's Handling of Deleted IAM Roles in Policies
EXPERT
Sercast
published 2 months ago

How can I attach an IAM managed policy to an IAM role in CloudFormation?

Short description

Resolution

Add an existing IAM managed policy to a new IAM role

Add a new IAM managed policy to a new IAM role

Add a new IAM managed policy to an existing IAM role

Related videos

Relevant content