Terraform IAM Policies: When to Use AWS Managed vs Custom Policies

A technical guide published on DEV Community explains the two core scenarios developers encounter when configuring IAM permissions in Terraform on AWS. When AWS already provides a suitable managed policy, developers can attach it directly to an IAM role using its ARN via the aws_iam_role_policy_attachment resource, without writing any custom permissions. For more specific access needs, such as restricting a Lambda function to a single S3 bucket, developers must build a custom policy using three steps: defining permissions with aws_iam_policy_document, creating the policy with aws_iam_policy, and attaching it to the role. The guide also clarifies key IAM terminology, including roles, policies, and ARNs, to help beginners navigate conflicting examples found online. Understanding which scenario applies is presented as the key to making IAM configuration in Terraform feel logical rather than arbitrary.