No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

Is it possible to attach multiple IAM policies to an IAM role at once?

Depends what you mean by “at once” - using multiple role policy attachments, yes

I mean in one statement, as opposed to having a bunch of `new aws.iam.RolePolicyAttachment`.

Ah, not really - there is no AWS primitive for that, so nothing exists in the Terraform provider to do that

With Pulumi you could use a loop or a `.map` or similar though instead of writing them out in full

If it doesn't already exist, seems like a useful function to include in a lib :slightly_smiling_face:

Do you have a reference in your program to a bunch of policies?

Yes. I have a `Output&lt;string[]&gt;` of policy arns.

```
youroutput.apply(x =&gt; x.map(y =&gt; new RolePolicyAttachment(...))))
```

It's acceptable to create resources in `apply`?

It’s not a best practice—the resources may not appear in previews and will not properly depend upon the inputs to the apply—but it will work.

Is there a best practice way to accomplish this?

Where is the output&lt;string&gt;[] coming from?

If it’s an output&lt;string&gt;[] rather than an output&lt;string[]&gt; then this becomes much neater - you can just map over the array directly and pass the output&lt;string&gt; into the attachment 

It is from other resources. I could make it a  output&lt;string&gt;[] I think.

Right now it's defined as this:
```
export let servicesPolicyArns = servicesIamPolicy.arn.apply(arn =&gt; {
    return [
        arn,
        "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
        "arn:aws:iam::aws:policy/AmazonEC2ContainerServiceFullAccess",
    ];
});
```
But it could be defined like this:
```
let servicesPolicyArns = [
    "arn:aws:iam::aws:policy/AWSLambdaFullAccess",
    "arn:aws:iam::aws:policy/AmazonEC2ContainerServiceFullAccess",
    servicesIamPolicy.arn
];
```