How to reference AWS managed policy arn in cloudformation?

user_5421539 0
Viewed 2157

I am going to create an IAM user with cloudformation and need to attach an AWS managed policy AWSAppSyncInvokeFullAccess. I think I should use the managed policy like below code:

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - !Ref AWSAppSyncInvokeFullAccess
        - !Ref AWSLambdaBasicExecutionRole

but it doesn't work since AWSAppSyncInvokeFullAccess is from AWS not from this template. What is the correct way to reference the policies?

amazon-cloudformation amazon-iam amazon-web-services
2 Answers

These are existing AWS-managed policies. So you should use their full ARN, which you can get from IAM console:

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AWSAppSyncInvokeFullAccess
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

Update

Or to make it partition independent:

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AWSAppSyncInvokeFullAccess"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
user_2488230

Just in case anyone was wondering you can find the ARNs of all IAM policies by clicking on the name of the policy on the Policies page.

user_35374740
Related