title: AWS CloudFormation - Attach existing managed policy to existing role through a template
body: <p>I am deploying a CloudFormation template to AWS. A role for my Lambda invocation is being created by a template that I am importing, and I cannot modify it directly. I wish to modify that role to attach the AWS managed policy <code>AWSLambdaVPCAccessExecutionRole</code> that already exists in my AWS account. So far, all of my searches have come up empty.</p>
  <ol>
  <li>I have found instructions for how to create a new role with an existing managed policy</li>
  <li>I have found instructions for how to create a new policy and attach it to an existing role.</li>
  <li>I have found instructions for how to Update a Stack using the AWS console or the CLI, but not via a template (YAML or JSON)</li>
  <li>I have found instructions for calling something called <code>aws_iam_role_policy_attachment</code> in something called Terraform, but that is not available to me</li>
  </ol>
  <p>I am hoping for something like the following but I cannot find any evidence of this existing anywhere. Is there anything that can do what I am trying to do?</p>
  <pre><code>---
  Resources:
    AdditionalRolePermissions:
      Type: &quot;AWS::IAM::RolePolicyAttachment&quot;
      Properties:
        Roles:
          - Ref: ExistingRole
        PolicyName:
          - Ref: ExistingPolicy
  </code></pre>
  <p>The best solution I have come up with so far is to create a new policy that has a manually created PolicyDocument that is the same as the existing one for <code>AWSLambdaVPCAccessExecutionRole </code> and attach it to the role upon creation. I would prefer not to do that though because it will be harder to maintain.</p>