Cloudformation how to reference Managed-Policy from another stack

Question

I have the following role. From within it I want to use an existing managed policy from another stack.

How can I do so?

"TestRole": {
    "Properties": {
      "AssumeRolePolicyDocument": {
        "Statement": [
          {
            "Action": [
              "sts:AssumeRole"
            ],
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "lambda.amazonaws.com"
              ]
            }
          }
        ],
        "Version": "2012-10-17"
      },
      "Path": "/lambda/",
      "Policies": [
        ??????
      ]
    },
    "Type": "AWS::IAM::Role"
  }

Answer 1

There's now a supported way to do this, using Imports/Exports. Basically, the stack that creates the policy has an output that contains the policy name (or ARN, not sure which is needed in this case), and declares it as an export with a regionally-unique name. Then, other stacks can consume it using the Import function.

For example, if the following stack (let's say it's named FooStack) creates the managed policy, it can have the following in its output:

"Outputs" : {
    "MyManagedPolicy" : {
        "Value" : { "Ref" : "MyManagedPolicy" },
        "Export" : { "Name" : {"Fn::Sub": "${AWS::StackName}-MyManagedPolicy" }}
    }
}

The other stack can use it:

"Policies": [
    { "Fn::ImportValue" : "FooStack-MyManagedPolicy" }
]

Answer 2

If your requirement is a stand-alone sharable policy. then you need to make it as ManagedPolicy and not a standard Policy.

An Example:

1

MyManagedPolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
  Path: "/"
  PolicyDocument:
    Version: "2012-10-17"
    Statement:
      - Effect: "Allow"
        Action:
          - "s3:*"
        Resource:
          - Fn::GetAtt: MyBucket.Arn

2

Export it:

MyManagedPolicy:
Description: MyManagedPolicy
Value:
  Ref: MyManagedPolicy
Export:
  Name:
    Fn::Join:
      - "-"
      - - "MyManagedPolicy"
        - Ref: StackName

Then in your other stack where you want to import this stand-alone managed policy in one of your roles, do this:

MyUserRole:
Type: "AWS::IAM::Role"
Properties:
  RoleName: "SomeName"
  AssumeRolePolicyDocument:
    Version: "2012-10-17"
    Statement:
      - Effect: "Allow"
        Principal:
          AWS: 
            - .....
        Action:
          - .....  
  Path: "/"
  ManagedPolicyArns:
    - Fn::ImportValue:
        Fn::Sub: "MyManagedPolicy-${StackName}"
  Policies:
    - PolicyName: "NameOfYouInlinePolicyWithoutSpaces"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Action:
              - .....
            Resource:
              - .....