how can I attach multiple pre-existing AWS managed roles to a policy?

Question

I want to associate existing policies in AWS to a role, I am using the terraform tool

I want to associate these policies, this code is with the aws cloudformation tool:

   AWSCodeCommitFullAccess
   AWSCodeBuildAdminAccess
   AWSCodeDeployFullAccess
   AWSCodePipelineFullAccess
   AWSElasticBeanstalkFullAccess

try with the attach

data "aws_iam_policy" "attach-policy" {
  arn = ["arn:aws:iam::aws:policy/AWSCodeCommitFullAccess", "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess", "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess", "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess"]
}

resource "aws_iam_role_policy_attachment" "tc-role-policy-attach" {
  role = "${aws_iam_role.toolchain-role.name}"

  policy_arn = "${data.aws_iam_policy.attach-policy.arn}"
}

Answer 1

You go with the right direction with terraform resource aws_iam_role_policy_attachment but need some adjustment.

AWS managed policies' ARN are exist in the system. For example, if you need attach the first managed policy to an IAM role,

resource "aws_iam_role_policy_attachment" "test-policy-AWSCodeCommitFullAccess" {
  policy_arn = "arn:aws:iam::aws:policy/AWSCodeCommitFullAccess"
  role       = "${aws_iam_role.toolchain-role.name}"
}

You can add other managed policies one by one.

If you want to do together, you can try below code

variable "managed_policies" {
  default = ["arn:aws:iam::aws:policy/AWSCodeCommitFullAccess",
    "arn:aws:iam::aws:policy/AWSCodeBuildAdminAccess",
    "arn:aws:iam::aws:policy/AWSCodeDeployFullAccess",
    "arn:aws:iam::aws:policy/AWSCodePipelineFullAccess",
  ]
}

resource "aws_iam_role_policy_attachment" "tc-role-policy-attach" {
  count      = "${length(var.managed_policies)}"
  policy_arn = "${element(var.managed_policies, count.index)}"
  role       = "${aws_iam_role.toolchain-role.name}"
}