How to attach existing privacy policy to IAM role via Terraform - amazon-web-services

Question

I need to create a new IAM role via Terraform. The role should have a policy that is predefined in AWS (AmazonSSMFullAccess), but I cannot find anywhere how should I add a policy that is already created.
Code template should look like this:
resource "aws_iam_role" "role" {
name = var.name
assume_role_policy = var.assume_role_policy
max_session_duration = var.max_session_duration
description = var.description
}
resource "aws_iam_role_policy_attachment" "attach_policy" {
policy_arn = var.policy_to_attach
role = aws_iam_role.role.name
}

Answer 1

For an existing aws policy, you can directly copy its arn from the console. Then simply paste the arn as the policy_arn parameter. In your case:
resource "aws_iam_role_policy_attachment" "attach_policy" {
policy_arn = "arn:aws:iam::aws:policy/AmazonSSMFullAccess"
role = aws_iam_role.role.name
}
To make it even more safe, you could first import the policy using a datasource :
data "aws_iam_policy" "example" {
arn = "arn:aws:iam::aws:policy/AmazonSSMFullAccess"
}
resource "aws_iam_role_policy_attachment" "attach_policy" {
policy_arn = data.aws_iam_policy.example.arn
role = aws_iam_role.role.name
}
EDIT: the datasource can also be summoned by name:
data "aws_iam_policy" "test" {
name = "AmazonSSMFullAccess"
}
As said in the comments, a datasource will be helpful to make terraform check that you can find and read the given policy before it tries to do anything else.