(upbeat electronic music)
- Hi there, I'm Zainub, a Cloud Support engineer
here at the AWS office in Cape Town, South Africa.
Today I'm going to show you
how to add a new or existing IAM managed policy
to an IAM role in AWS CloudFormation.
Let's get started!
To do this, we'll use the ManagedPolicyArns property
of the AWS::IAM::Role resource type.
Note that a maximum of 10 managed policies
can be attached to an IAM role or user.
Also, the size of each policy
must not exceed 6,144 characters.
You can find more information
in the Limitations on IAM Entities
and Objects documentation.
This video assumes you're familiar with
creating stacks, writing stack templates,
and modifying a stack template.
For the purpose of this video,
I'll use the AWS Management Console
for editing the stack template.
After you log into the AWS Management Console,
navigate to the CloudFormation Console.
If you have an existing stack that you want to update,
you can select that stack now,
or you can use the Designer to create a new template.
For this video, I'll update an existing stack.
We can use the Designer to create or update the template.
To add existing managed policies to IAM role,
you can make use of stack parameters,
which allows you to pass in the ARN of policies
on stack creation or update.
Here I'll demonstrate how to use parameters
for two existing roles,
which I've given the logical resource name
of ExamplePolicyOne and ExamplePolicyTwo.
In the template, navigate to the IAM::Role resource
you want to attach the policy to.
Under the properties section of the resource,
add the ManagedPolicyArns property.
We'll use the CloudFormation Ref intrinsic function
to reference the existing policies
that we pass in through the ExamplePolicyOne
and ExamplePolicyTwo parameters.
And that's how you attach existing policies
to a CloudFormation IAM::Role resource.
To add a new IAM policy resource to the stack,
navigate to the resources section of the template
and add a new AWS IAM::ManagedPolicy resource type
with the required properties.
For this example,
I'll give the new policy a logical resource name
of NewExamplePolicy,
as well as simple IAM action permissions.
Here again, I'll make use of the Ref intrinsic function
to reference the new policy
in the ManagedPolicyArns property of the IAM::Role.
Now that the policies are attached,
you can refresh to view changes.
You can also validate and then upload the template.
Click Next.
Click Next and Next.
Select the Acknowledge box,
and then choose Update stack,
or Create stack if you are creating a new stack.
We can verify that the policies
have been attached to the role
by viewing the stack resources and selecting the role.
The role created in the stack
is a combination of the stack name,
logical resource name, and string of random characters
unless you added the RoleName property to the resource.
You now see the policy is attached to the role.
That's how to attach a new or existing policy
to a role through CloudFormation.
Thanks for watching,
and happy Cloud computing
from all of us here at AWS.
(upbeat electronic music)