Attaching a Policy with aws iam attach-role-policy

When a role needs permissions, use aws iam attach-role-policy. It attaches a policy to a role.

The syntax is aws iam attach-role-policy --role-name name --policy-arn arn.

Running aws iam attach-role-policy --role-name my-role --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess grants that role read-only access across the account.

A common stumble is attaching a broad managed policy because it is quick, then never narrowing it. Convenient today, a liability later.

In real work, this is how an application's role is given exactly the access it needs — say, reading one specific S3 bucket.