An IAM role has the AWSSupportAccess policy attached

# IAM role with AWS Support access
resource "aws_iam_role" "example_resource_name" {
  name               = "example_resource_name"
  assume_role_policy = jsonencode({
    Version   = "2012-10-17",
    Statement = [{
      Effect    = "Allow",
      Principal = { AWS = "arn:aws:iam::<example_account_id>:user/<example_resource_name>" },
      Action    = "sts:AssumeRole"
    }]
  })

  managed_policy_arns = [
    "arn:aws:iam::aws:policy/AWSSupportAccess"  # Critical: ensures this role has AWSSupportAccess (PASS)
  ]
}

# CloudFormation: create a role with AWS Support access
Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::<example_account_id>:user/<example_resource_name>
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSSupportAccess  # Critical: attaches AWS Support access so at least one role has this policy (PASS)