title: creating aws IAM Role using cloudformation does not create RolePolicies
body: <p>I'm creating an ec2 instance with a role that provides access to kinesis streams and Dynamodb offset Tables. I am using <a href="https://aws.amazon.com/cloudformation/" rel="nofollow noreferrer"><code>aws cloudformation</code></a> for that.</p>
  
  <p><strong>Problem I'm having is while creating the <a href="http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html" rel="nofollow noreferrer">Streaming Access IAM Role</a> itself.</strong></p>
  
  <p>So, I will have following structure,</p>
  
  <pre><code>                        has
  StreamingAccessRole ----------&gt; RolePolicy1(kinesis:*), RolePolicy2(dynamodb:*)
  </code></pre>
  
  <p>The template to create the AWS IAM role with two policies, one for kinesis and the other for dynamodb :  </p>
  
  <pre><code>{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Parameters": {
      "teamIdentifier": {
        "Type": "String",
        "Default": "a28",
        "Description": "Identifier for the team"
      }
    },
    "Resources": {
      "StreamingAccessRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
          "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Principal": {
                  "Service": [
                    "ec2.amazonaws.com"
                  ]
                },
                "Action": [
                  "sts:AssumeRole"
                ]
              }
            ]
          },
          "Path": "/a28/",
          "Policies": [
            {
              "PolicyName": "Stream-ConsumerOffset-RW-AccessPolicy",
              "PolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                  {
                    "Effect": "Allow",
                    "Action": "kinesis:*",
                    "Resource": "arn:aws:kinesis:us-west-2:*:stream/a28-*"
                  },
                  {
                    "Effect": "Allow",
                    "Action": "dynamodb:*",
                    "Resource": "arn:aws:dynamodb:us-west-2:*:table/a28-*"
                  }
                ]
              }
            }
          ]
        }
      }
    }
  }
  </code></pre>
  
  <p>It creates the Access Role but without role-policies.</p>
  
  <pre><code>$ aws iam get-role --role-name a28-streaming-access-role-st-StreamingAccessRole-14QHMTIOIRN5X --region us-west-2 --profile aws-federated
  {
      "Role": {
          "AssumeRolePolicyDocument": {
              "Version": "2012-10-17", 
              "Statement": [
                  {
                      "Action": "sts:AssumeRole", 
                      "Effect": "Allow", 
                      "Principal": {
                          "Service": "ec2.amazonaws.com"
                      }
                  }
              ]
          }, 
          "RoleId": "AROAIFD6X2CJXTKLVQNLE", 
          "CreateDate": "2017-04-07T18:54:59Z", 
          "RoleName": "a28-streaming-access-role-st-StreamingAccessRole-14QHMTIOIRN5X", 
          "Path": "/a28/", 
          "Arn": "arn:aws:iam::500238854089:role/a28/a28-streaming-access-role-st-StreamingAccessRole-14QHMTIOIRN5X"
      }
  }
  </code></pre>
  
  <p>Listing the role-policies</p>
  
  <pre><code>$ aws iam list-role-policies --role-name a28-streaming-access-role-st-StreamingAccessRole-14QHMTIOIRN5X --region us-west-2 --profile aws-federated
  {
      "PolicyNames": []
  }
  </code></pre>
  
  <p>which means it did not even create any policies,</p>
  
  <pre><code>aws iam list-policies --region us-west-2 --profile aws-federated | grep Stream-ConsumerOffset-RW-AccessPolicy
  </code></pre>
  
  <p>But <strong>if I supplied only <code>kinesis:*</code> statement in above example</strong>, it creates a policy, but not with <code>dynamodb:*</code> alone.</p>
  
  <p><a href="https://i.stack.imgur.com/FeMwR.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FeMwR.png" alt="no policies created"></a>
  So, my question is <strong>how am supposed to provide multiple RolePolicies using one cloudformation AWS::IAM::Role template</strong>, or is this specific to dynamodb?</p>