attach_role_policy async ¶

async def attach_role_policy(
    self,
    role_name: "capo_iam.types.role_name_type.roleNameType",
    policy_arn: "capo_iam.types.arn_type.arnType",
    *,
    config_overrides: Optional[AsyncIAMClientConfig] = None,
) -> None:
    """<p>Attaches the specified managed policy to the specified IAM role. When you attach a managed policy to a role, the managed policy becomes part of the role's permission (access) policy.</p> <note> <p>You cannot use a managed policy as the role's trust policy. The role's trust policy is created at the same time as the role, using <a href="https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateRole.html"> <code>CreateRole</code> </a>. You can update a role's trust policy using <a href="https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateAssumeRolePolicy.html"> <code>UpdateAssumerolePolicy</code> </a>.</p> </note> <p>Use this operation to attach a <i>managed</i> policy to a role. To embed an inline policy in a role, use <a href="https://docs.aws.amazon.com/IAM/latest/APIReference/API_PutRolePolicy.html"> <code>PutRolePolicy</code> </a>. For more information about policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/policies-managed-vs-inline.html">Managed policies and inline policies</a> in the <i>IAM User Guide</i>.</p> <p>As a best practice, you can validate your IAM policies. To learn more, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_policy-validator.html">Validating IAM policies</a> in the <i>IAM User Guide</i>.</p>

    Args:
        role_name: <p>The name (friendly name, not ARN) of the role to attach the policy to.</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-</p>
        policy_arn: <p>The Amazon Resource Name (ARN) of the IAM policy you want to attach.</p> <p>For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon Resource Names (ARNs)</a> in the <i>Amazon Web Services General Reference</i>.</p>

    Raises:
        capo_iam.errors.invalid_input_exception.InvalidInputException: <p>The request was rejected because an invalid or out-of-range value was supplied for an input parameter.</p>
        capo_iam.errors.limit_exceeded_exception.LimitExceededException: <p>The request was rejected because it attempted to create resources beyond the current Amazon Web Services account limits. The error message describes the limit exceeded.</p>
        capo_iam.errors.no_such_entity_exception.NoSuchEntityException: <p>The request was rejected because it referenced a resource entity that does not exist. The error message describes the resource.</p>
        capo_iam.errors.policy_not_attachable_exception.PolicyNotAttachableException: <p>The request failed because Amazon Web Services service role policies can only be attached to the service-linked role for that service.</p>
        capo_iam.errors.service_failure_exception.ServiceFailureException: <p>The request processing has failed because of an unknown error, exception or failure.</p>
        capo_iam.errors.unmodifiable_entity_exception.UnmodifiableEntityException: <p>The request was rejected because service-linked roles are protected Amazon Web Services resources. Only the service that depends on the service-linked role can modify or delete the role on your behalf. The error message includes the name of the service that depends on this service-linked role. You must request the change through that service.</p>
        capo_iam.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        To attach a managed policy to an IAM role
        The following command attaches the AWS managed policy named ReadOnlyAccess to the IAM role named ReadOnlyRole.

        >>> await client.attach_role_policy(role_name='ReadOnlyRole', policy_arn='arn:aws:iam::aws:policy/ReadOnlyAccess')
    """

    async def _handler(
        req: "AsyncOperationRequest[capo_iam.types.attach_role_policy_request.AttachRolePolicyRequest]",
    ) -> AsyncOperationResponse[None]:
        import capo_iam._operations.aws_identity_management_v20100508.attach_role_policy

        (
            output,
            http_response,
        ) = await capo_iam._operations.aws_identity_management_v20100508.attach_role_policy.async_attach_role_policy(
            req.options, req.input
        )
        return AsyncOperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("AttachRolePolicy")
    )
    input_: capo_iam.types.attach_role_policy_request.AttachRolePolicyRequest = {
        "role_name": role_name,
        "policy_arn": policy_arn,
    }

    response = await aexecute_pipeline(
        AsyncOperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    await response.response.aclose()
    return response.output