74

I want to attach multiple IAM Policy ARNs to a single IAM Role.

One method is to create a new policy with privileges of all the policies (multiple policies).

But in AWS, we have some predefined IAM policies like AmazonEC2FullAccess, AmazomS3FullAccess, etc. I want to use a combination of these for my role.

I could not find a way to do so in the Terraform documentation.

As per documentation we can use aws_iam_role_policy_attachment to attach a policy to a role, but not multiple policies to a role as this is available via AWS console.

Please let me know if there is a method to do the same or is it still a feature to be added.

The Terraform version I use is v0.9.5

7 Answers 7

81
Answer recommended by AWS Collective

For Terraform versions >= 0.12 the cleanest way to add multiple policies is probably something like this:

resource "aws_iam_role_policy_attachment" "role-policy-attachment" {
  for_each = toset([
    "arn:aws:iam::aws:policy/AmazonEC2FullAccess", 
    "arn:aws:iam::aws:policy/AmazonS3FullAccess"
  ])

  role       = var.iam_role_name
  policy_arn = each.value
}

As described in Pranshu Verma's answer, the list of policies can also be put into a variable.

Using for_each in favor of count has the advantage, that insertions to the list are properly recognized by terraform so that it would really only add one policy, while with count all policies after the insertion would be changed (this is described in detail in this blog post)

5
  • Note that using a variable for the list causes plan time errors, because TF doesn't know at the time how many items are in the list
    – J Hamm
    Commented Mar 3, 2021 at 11:25
  • 3
    Full error message for reference: The "for_each" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use the -target argument to first apply only the resources that the for_each depends on.
    – J Hamm
    Commented Mar 3, 2021 at 11:26
  • 1
    @JHamm correct. This error appears in cases where the argument of for_each depends on outputs of resources (it works with variables though). In such a case, if the number of resources is known in advance, one can still list the resources one by one as in the answer of krishna_mee2004. I have not tested if using count, as in the accepted answer still works in situations where the number of resources depend on the resource output. Commented Mar 3, 2021 at 16:43
  • 3
    Indeed, for_each doesn't work in case there is a reference in a set. For example for_each = toset(["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy", aws_iam_policy.handy_ecs_tasks_execution_role_iam_policy.arn]). However, count works fine in this case. Commented Mar 31, 2022 at 15:41
  • to fix for_each, terraform suggests to use a one off -target invocation, ie terraform apply -target aws_iam_policy.handy_ecs_tasks_execution_role_iam_policy. terraform apply should work afterwards Commented Jun 30, 2022 at 21:27
51

Thanks Krishna Kumar R for the hint.

A little more polished answer I reached from your answer.

# Define policy ARNs as list
variable "iam_policy_arn" {
  description = "IAM Policy to be attached to role"
  type = "list"
}

# Then parse through the list using count
resource "aws_iam_role_policy_attachment" "role-policy-attachment" {
  role       = "${var.iam_role_name}"
  count      = "${length(var.iam_policy_arn)}"
  policy_arn = "${var.iam_policy_arn[count.index]}"
}

And finally the list of policies should be specified in *.tfvars file or in command line using -var, for example:

iam_policy_arn = [ "arn:aws:iam::aws:policy/AmazonEC2FullAccess", "arn:aws:iam::aws:policy/AmazonS3FullAccess"]

5
  • 1
    Only downside to this is that you can't set a default value with interpolation in variables so you can't reference arn from a aws_iam_policy 's resource or data. The default value will only take a text list.
    – GabLeRoux
    Commented Feb 27, 2019 at 13:53
  • 1
    This answer seems incomplete to me. How is the policy for e.g. AmazonEC2FullAccess brought in here?
    – Magnus
    Commented Jan 19, 2020 at 4:57
  • Is there a way to check if the managed policy is already attached to the target role or not? say a check before attaching and attach only if it not already attach to the Role. Commented Oct 15, 2020 at 11:11
  • @magnus It is brought in via the iam_policy_arn list variable. Note that AmazonEC2FullAccess is an AWS Managed Policy - predefined by AWS HQ. :) Commented May 7, 2021 at 16:11
  • Using Terraform's new syntax, this would be: # Define policy ARNs as list variable "iam_policy_arn" { description = "IAM Policy to be attached to role" type = list(string) } # Then parse through the list using count resource "aws_iam_role_policy_attachment" "role-policy-attachment" { role = var.iam_role_name count = length(var.iam_policy_arn) policy_arn = var.iam_policy_arn[count.index] }
    – Mark
    Commented Sep 21, 2021 at 21:15
36

Did you try something like this:

resource "aws_iam_role" "iam_role_name" {
  name = "iam_role_name"
}

resource "aws_iam_role_policy_attachment" "mgd_pol_1" {
  name       = "mgd_pol_attach_name"
  role       = "${aws_iam_role.iam_role_name.name}"
  policy_arn = "${aws_iam_policy.mgd_pol_1.arn}"
}

resource "aws_iam_role_policy_attachment" "mgd_pol_2" {
  name       = "mgd_pol_attach_name"
  role       = "${aws_iam_role.iam_role_name.name}"
  policy_arn = "${aws_iam_policy.mgd_pol_2.arn}"
}
5
  • 2
    Thanks that solves my purpose, but can there be a more cleaner way to pass the ARNs as a list. Actually I created a module in similar fashion to create a role attach multiple policies but executing it twice was overwriting previous attachments. Commented Aug 3, 2017 at 14:12
  • 3
    assume_role_policy is a required field in "aws_iam_role"
    – Cnf271
    Commented Oct 30, 2020 at 14:38
  • The argument "assume_role_policy" is required, but no definition was found. Not sure how you got this working? Commented Apr 28, 2021 at 14:45
  • I understood the error about assume_role_policy. You need create or get a policy_document. This terraform doc example show how do that: Commented Jul 7, 2021 at 1:52
2

1.Use a datasource with for loop to get all the policies

data "aws_iam_policy" "management_group_policy" {
  for_each = toset(["Billing", "AmazonS3ReadOnlyAccess"])
  name     = each.value
}

2.Attach to role as so;

resource "aws_iam_role_policy_attachment" "dev_role_policy_attachment" {
  for_each   = data.aws_iam_policy.management_group_policy
  role       = aws_iam_role.role.name
  policy_arn = each.value.arn
}
2

In my case I added multiple statements in one policy document:

data "aws_iam_policy_document" "sns-and-sqs-policy" {
  statement {
    sid    = "AllowToPublishToSns"
    effect = "Allow"
    actions = [
      "sns:Publish",
    ]
    resources = [
"arn:aws:sns:${data.aws_region.current.name}:${data.aws_caller_identity.current.id}:*"
    ]
  }
  statement {
    sid    = "AllowToSubscribeFromSqs"
    effect = "Allow"
    actions = [
      "sqs:changeMessageVisibility*",
      "sqs:SendMessage",
      "sqs:ReceiveMessage",
      "sqs:GetQueue*",
      "sqs:DeleteMessage",
    ]
    resources = [
      data.resource.arn,
    ]
  }
}

resource "aws_iam_policy" "sns-and-sqs" {
  name   = "sns-and-sqs-policy"
  policy = data.aws_iam_policy_document.sns-and-sqs-policy.json
}

resource "aws_iam_role_policy_attachment" "sns-and-sqs-role" {
  role       = "role_name"
  policy_arn = aws_iam_policy.sns-and-sqs.arn
}

simply combine your policies to multiple statements in one policy

2
  • This doesn't work specifically when one statement has "Action": "sts:AssumeRole". AWS replies creating IAM Role (myrole): MalformedPolicyDocument: AssumeRole policy may only specify STS AssumeRole actions. For just actions, seems good.
    – Randy
    Commented Mar 22 at 13:36
  • @Randy because there is a difference between assume_role_policy and the policy in the example, the resources policy can be managed in the same way in the original comment but to manage the assume role policy is here: registry.terraform.io/providers/hashicorp/aws/latest/docs/… it can added directly to the aws_iam_role resource and it can't be attached. Commented Mar 22 at 16:08
1

Adding another option, which is similar to the excepted answer but instead of:

policy_arn = "${var.iam_policy_arn[count.index]}"

You can use the element function:

policy_arn = "${element(var.iam_policy_arn,count.index)}"

I think that in some cases (like a project with a large amount of code) this could be more readable.

0

This is an example how i did it:

resource "aws_iam_group_policy_attachment" "policy_attach_example" {
  for_each   = aws_iam_policy.example
  group      = aws_iam_group.example.name
  policy_arn = each.value["arn"]
}

So basically "aws_iam_policy.example" is a list of policies that i have made in the same way, with for_each

Hope that this help you, i know i come late but i had this simillar issue

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.