AWSAWS Identity and Access ManagementSecurity & Identity

`aws_iam_role_policy` cost estimation

An inline IAM policy embedded directly in a role. IAM is completely free, there is no charge for roles, policies, or evaluation. The cost lives in the AWS services the policy grants access to.

The aws_iam_role_policy resource attaches an inline JSON permissions policy directly to an IAM role. Unlike aws_iam_policy (a standalone managed policy that can be reused across principals), an inline policy has a strict one to one relationship with its role: it exists only as long as the role exists and is deleted with it.

IAM is a free service. AWS does not charge for roles, users, groups, inline policies, managed policies, policy evaluation, or the number of API authorization decisions made. You can create thousands of role policies and pay nothing for IAM itself. This is deliberate, IAM is the control plane that gates access to every paid AWS service, so AWS keeps it free to encourage least-privilege design.

The real cost is downstream. An IAM role policy is the key that unlocks spend. A policy that grants ec2:RunInstances lets a workload launch instances that bill by the hour. A policy that grants s3:PutObject enables storage and request charges. An overly broad policy (for example Action "*" on Resource "*") does not cost more in IAM terms, but it dramatically widens the blast radius: a compromised credential or a runaway automation can spin up expensive resources across every service. Cost governance and security governance are the same problem here.

There are also indirect costs to be aware of. If you log and analyze IAM activity through CloudTrail data events, AWS Config rules that evaluate IAM policies, or Access Analyzer findings routed to Security Hub, those downstream analysis services bill even though the policy itself does not. IAM Access Analyzer external access analysis is free, but unused access analysis is a paid feature billed per IAM role and user analyzed.

c3x treats aws_iam_role_policy as a free resource and does not add it to your estimate, but it is worth auditing what each policy grants because that is where future spend originates.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_iam_role" "app" {
  name = "app-runtime-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action    = "sts:AssumeRole"
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
    }]
  })
}

resource "aws_iam_role_policy" "app_s3_read" {
  name = "app-s3-read"
  role = aws_iam_role.app.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject", "s3:ListBucket"]
      Resource = [
        "arn:aws:s3:::my-app-data",
        "arn:aws:s3:::my-app-data/*",
      ]
    }]
  })
}

Pricing dimensions

What you actually pay for when you provision aws_iam_role_policy.

Dimension	Unit	What's being charged
IAM inline role policy	free	Roles, inline policies, and all IAM authorization decisions are free. There is no per-policy or per-evaluation charge. $0 (free)
IAM Access Analyzer (unused access)	per analyzed principal	Optional unused access analysis that flags stale roles and users. External access analysis remains free. $0.20 per IAM role or user analyzed per month
AWS Config rule evaluation	per evaluation	If you evaluate IAM policies with Config rules, each configuration item evaluation bills. $0.001 per rule evaluation

Optimization tips

Common ways to reduce aws_iam_role_policy cost without changing the workload.

Scope policies to specific actions and resources

The IAM policy costs nothing, but a wildcard grant lets any holder of the credential launch expensive resources. Scoping ec2, rds, and sagemaker actions to named resources and adding conditions caps the potential runaway spend a compromised role can cause.

Prefer managed policies for reuse, inline for uniqueness

Inline policies are deleted with the role and cannot be reused, which is good for one off grants but leads to drift when the same permissions are copied across many roles. Use aws_iam_policy when several roles need identical permissions so you audit and update in one place.

Add cost-control conditions to launch permissions

For roles that can create instances, use condition keys like ec2:InstanceType or aws:RequestedRegion to block oversized or off-region resources. This turns the free policy into a guardrail against accidental large bills.

Retire unused roles flagged by Access Analyzer

Unused roles are not billed by IAM, but they are a security and audit liability. Access Analyzer unused access analysis surfaces stale roles so you can delete them and shrink the attack surface.

FAQ

Does an IAM role policy cost anything?

No. IAM is free. There is no charge for roles, inline policies, managed policies, or the authorization decisions IAM makes on every API call. AWS monetizes the services the policies grant access to, not IAM itself.

What is the difference between aws_iam_role_policy and aws_iam_policy?

aws_iam_role_policy is an inline policy embedded in a single role and deleted with it. aws_iam_policy is a standalone managed policy that can be attached to many roles, users, and groups via aws_iam_role_policy_attachment. Both are free. Managed policies are better for reuse and central auditing.

If IAM is free, why does it show up in cost discussions?

Because IAM policies are where spend authorization begins. A policy that grants broad create permissions is the mechanism by which a compromised credential or buggy automation can generate large bills. Cost governance teams review IAM to understand what a workload is allowed to provision.

Are there any IAM features that do cost money?

IAM Access Analyzer unused access analysis is billed per IAM role and user analyzed per month. External access analysis is free. IAM itself, including roles and policies, is always free.