Cloudformation template to attach existing policy to existing IAM role

Question

I want to attach an aws managed policy to an existing role. I am achieving this using template:

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "AWS CloudFormation template to modify Role",
    "Parameters": {
        "MyRole": {
            "Type": "String",
            "Default": "MyRole",
            "Description": "Role to be modified"
        }
    },
    "Resources": {
        "S3FullAccess": {
            "Type": "AWS::IAM::ManagedPolicy",
            "Properties": {
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Effect": "Allow",
                        "Action": [
                            "s3:*",
                            "s3-object-lambda:*"
                        ],
                        "Resource": "*"
                    }]
                },
                "Roles": [
                    "MyRole"
                ]
            }
        }
    }
}

This template will create a policy with s3FullAccess and attach it to MyRole. But I do not want to create a new policy, if I want to use the policy already present with aws for s3 full access, how can I do that.

And if I use this template:

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "AWS CloudFormation template to modify Role",
    "Resources": {
        "IAMRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "Path": "/",
                "ManagedPolicyArns": [
                    "arn:aws:iam::aws:policy/ReadOnlyAccess"
                ],
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Action": "sts:AssumeRole",
                        "Effect": "Allow",
                        "Principal": {
                            "AWS": "*"
                        }
                    }]
                },
                "RoleName": "RoleName"
            }
        }
    }
}

This will attempt to create a new role and attach ReadOnlyPolicy to it. But if I want to attach a policy to existing role, how to refer that role in the template.

Answer 1

You use your AWS::IAM::Role 's ManagedPolicyArns property, where you just specify the ARN of the manage policy to attach.

Answer 2

In general, CloudFormation service is for creating resources. There is not a native support to do something with already created resources if you don't import them.

If you don't want to import them, then, you have an option to write CloudFormation custom resource. You can create a lambda function-backed custom resource passing in the ARNs of the IAM policy and the IAM role you want to attach the policy to by IAM AttachRolePolicy API. More details are in AWS documentation .