add delete_policies arg

salt/states/boto_iam_role.py

@@ -72,6 +72,10 @@ with the role. This is the default behavior of the AWS console.
             - profile:
                 key: GKTADJGHEIQSXMKKRBJ08H
                 keyid: askdjghsdfjkghWupUjasdflkdfklgjsdfjajkghs
+
+If ``delete_policies: False`` is specified, existing policies that are not in
+the given list of policies will not be deleted. These allow manual
+modifications on the IAM role to be persistent.
 '''
 from __future__ import absolute_import
 import salt.utils.dictupdate as dictupdate
@@ -95,7 +99,8 @@ def present(
         region=None,
         key=None,
         keyid=None,
-        profile=None):
+        profile=None,
+        delete_policies=True):
     '''
     Ensure the IAM role exists.
 
@@ -170,7 +175,8 @@ def present(
             ret['result'] = _ret['result']
             if ret['result'] is False:
                 return ret
-    _ret = _policies_present(name, _policies, region, key, keyid, profile)
+    _ret = _policies_present(name, _policies, region, key, keyid, profile,
+                             delete_policies)
     ret['changes'] = dictupdate.update(ret['changes'], _ret['changes'])
     ret['comment'] = ' '.join([ret['comment'], _ret['comment']])
     if not _ret['result']:
@@ -305,7 +311,8 @@ def _policies_present(
         region=None,
         key=None,
         keyid=None,
-        profile=None):
+        profile=None,
+        delete_policies=True):
     ret = {'result': True, 'comment': '', 'changes': {}}
     policies_to_create = {}
     policies_to_delete = []
@@ -318,7 +325,7 @@ def _policies_present(
     _list = __salt__['boto_iam.list_role_policies'](name, region, key, keyid,
                                                     profile)
     for policy_name in _list:
-        if policy_name not in policies:
+        if delete_policies and policy_name not in policies:
             policies_to_delete.append(policy_name)
     if policies_to_create or policies_to_delete:
         _to_modify = list(policies_to_delete)
@@ -357,7 +364,7 @@ def _policies_present(
                                                                 profile)
                 ret['changes']['new'] = {'policies': _list}
                 ret['result'] = False
-                msg = 'Failed to add policy {0} to role {1}'
+                msg = 'Failed to remove policy {0} from role {1}'
                 ret['comment'] = msg.format(policy_name, name)
                 return ret
         _list = __salt__['boto_iam.list_role_policies'](name, region, key,