title: Template to create IAM role for spectrum S3 access
body: <p>In order to access S3 data through spectrum, I need to create an IAM role as explained here...</p>
  
  <p><a href="https://docs.aws.amazon.com/redshift/latest/mgmt/authorizing-redshift-service.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/redshift/latest/mgmt/authorizing-redshift-service.html</a></p>
  
  <p>The newly created IAM role needs to be attached to redshift instance.</p>
  
  <p><a href="https://docs.aws.amazon.com/redshift/latest/mgmt/copy-unload-iam-role.html#copy-unload-iam-role-associating-with-clusters" rel="nofollow noreferrer">https://docs.aws.amazon.com/redshift/latest/mgmt/copy-unload-iam-role.html#copy-unload-iam-role-associating-with-clusters</a></p>
  
  <p>I have managed to complete all the steps successfully. But I will like to know if a cloudformation template can be written that will be do the needful quickly.
  Here is relevant code that I have extracted. I am not sure how to put is in correct syntax.</p>
  
  <p>Step 1</p>
  
  <pre><code>{
          "Tags": [],
          "AssumeRolePolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                  {
                      "Action": "sts:AssumeRole",
                      "Effect": "Allow",
                      "Principal": {
                          "Service": "redshift.amazonaws.com"
                      }
                  }
              ]
          },
          "RoleId": "AROAJWJGDMYIHSSTPZ6I6CM",
          "CreateDate": "2017-05-15T05:34:46Z",
          "InstanceProfileList": [],
          "RoleName": "RedshiftCopyUnload",
          "Path": "/",
          "AttachedManagedPolicies": [
              {
                  "PolicyName": "AmazonAthenaFullAccess",
                  "PolicyArn": "arn:aws:iam::aws:policy/AmazonAthenaFullAccess"
              },
              {
                  "PolicyName": "AmazonS3ReadOnlyAccess",
                  "PolicyArn": "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
              },
              {
                  "PolicyName": "AWSGlueConsoleFullAccess",
                  "PolicyArn": "arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess"
              }
          ],
          "RolePolicyList": [],
          "Arn": "arn:aws:iam::123456789012:role/RedshiftCopyUnload"
      }
  </code></pre>
  
  <p>Step 2</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": "redshift:DescribeClusters",
              "Resource": "*"
          },
          {
              "Effect": "Allow",
              "Action": [
                   "redshift:ModifyClusterIamRoles",
                   "redshift:CreateCluster"
              ],
              "Resource": [
                   "arn:aws:redshift:us-east-1:123456789012:cluster:my-redshift-cluster",
                   "arn:aws:redshift:us-east-1:123456789012:cluster:cluster:my-second-redshift-cluster"
              ]
          },
          {
              "Effect": "Allow",
              "Action": "iam:PassRole",
              "Resource": [
                  "arn:aws:iam::123456789012:role/MyRedshiftRole",
                  "arn:aws:iam::123456789012:role/SecondRedshiftRole",
                  "arn:aws:iam::123456789012:role/ThirdRedshiftRole"
               ]
          }
      ]
  }
  </code></pre>
  
  <hr>
  
  <p>Update: will the following cloudformation template correctly create the role mentioned in step 1?</p>
  
  <pre><code>{
    "Resources": {
      "NewRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
          "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Principal": {
                  "Service": [
                    "redshift.amazonaws.com"
                  ]
                },
                "Action": [
                  "sts:AssumeRole"
                ]
              }
            ]
          },
          "RoleName": "RedshiftCopyUnload",
          "Path": "/",
          "ManagedPolicyArns": [
            "arn:aws:iam::aws:policy/AmazonAthenaFullAccess",
            "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
            "arn:aws:iam::aws:policy/AWSGlueConsoleFullAccess"
          ]
        }
      }
    }
  }
  </code></pre>