AWSAWS Identity and Access ManagementSecurity & Identity

`aws_iam_role_policy_attachment` cost estimation

Links a managed IAM policy to a role. The attachment is free, as is all of IAM. What it grants determines how much the role can spend, so it is a cost-governance control point.

The aws_iam_role_policy_attachment resource binds an existing managed policy (either AWS managed, like AmazonS3ReadOnlyAccess, or a customer managed aws_iam_policy) to an IAM role. It is the join between a reusable policy and a principal. A single managed policy can be attached to many roles, and a role can have up to 10 managed policies attached by default (a soft quota that can be raised).

Like everything in IAM, the attachment costs nothing. There is no charge for attaching, detaching, or evaluating policies, and no charge based on how many policies a role carries. AWS keeps the entire authorization layer free because it gates access to the paid services.

The cost relevance is governance. Attaching a broad AWS managed policy such as AdministratorAccess or PowerUserAccess to a role gives that role the ability to create expensive resources across nearly every service. That is not a billing event in itself, but it sets the ceiling on how much spend a compromised or misbehaving workload can generate. Cost and security reviews look at policy attachments to answer a simple question: what is this role allowed to provision, and how large could the bill get if it went wrong.

A common anti-pattern is convenience attachment of wide AWS managed policies during development that then survive into production. Because there is no cost signal, these grants persist silently. The fix is least privilege: attach narrowly scoped customer managed policies, and prefer job-function policies (like AmazonEC2ReadOnlyAccess) over blanket admin grants.

There are indirect costs if you evaluate attachments with AWS Config rules (each rule evaluation bills a fraction of a cent) or route findings to Security Hub. IAM Access Analyzer can flag roles with unused permissions, and its unused access analysis is billed per role and user analyzed. c3x classifies aws_iam_role_policy_attachment as free and excludes it from estimates, while noting it is a key control point for capping downstream spend.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_iam_role" "readonly" {
  name = "audit-readonly-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action    = "sts:AssumeRole"
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::111122223333:root" }
    }]
  })
}

# Attach a narrowly scoped AWS managed policy rather than a broad admin grant.
resource "aws_iam_role_policy_attachment" "readonly" {
  role       = aws_iam_role.readonly.name
  policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
}

Pricing dimensions

What you actually pay for when you provision aws_iam_role_policy_attachment.

Dimension	Unit	What's being charged
IAM policy attachment	free	Attaching or detaching managed policies is free, and IAM does not charge based on the number of attachments. $0 (free)
AWS Config rule evaluation (if used)	per evaluation	If Config rules evaluate policy attachments for compliance, each evaluation bills a fraction of a cent. $0.001 per rule evaluation
IAM Access Analyzer (unused access)	per analyzed principal	Optional analysis that flags roles carrying unused permissions granted by attachments. $0.20 per IAM role or user analyzed per month

Optimization tips

Common ways to reduce aws_iam_role_policy_attachment cost without changing the workload.

Attach least-privilege policies, not blanket admin

Attaching AdministratorAccess or PowerUserAccess costs nothing but sets the maximum spend a role can generate if compromised. Replace broad grants with narrowly scoped customer managed policies or job-function AWS managed policies.

Reuse one managed policy across roles

Because a managed policy attaches to many roles, define permissions once and attach widely. This avoids inline-policy drift and makes it easy to tighten a grant everywhere at once when a cost or security review demands it.

Remove stale attachments from old environments

Convenience grants added during development often survive into production with no cost signal to prompt cleanup. Periodically audit attachments and detach any that a role no longer needs.

Use Access Analyzer to find over-permissioned roles

Unused access analysis highlights roles whose attached policies grant permissions never used. Trimming them shrinks both the security blast radius and the potential for accidental expensive resource creation.

FAQ

Does attaching a policy to a role cost money?

No. Policy attachments are free, and IAM does not charge based on how many policies a role carries. The entire IAM authorization layer is free because it controls access to the paid services.

How is this different from aws_iam_role_policy?

aws_iam_role_policy_attachment links an existing standalone managed policy to a role, and one policy can serve many roles. aws_iam_role_policy embeds an inline policy that lives and dies with a single role. Both are free; attachments are preferred when permissions are shared and audited centrally.

How many policies can I attach to one role?

By default up to 10 managed policies per role, a soft quota you can request to increase. Each policy also has a size limit. There is no cost tied to the count, only the quota.

Why do cost reviews care about policy attachments?

Because an attachment defines what a role is allowed to provision. A role with AdministratorAccess can create GPU fleets and cross-region data transfer; a role with ReadOnlyAccess cannot spend anything. The attachment caps the potential bill from a misbehaving or compromised workload.