diff --git a/roles.tf b/roles.tf
index aeccc9d..c279235 100644
--- a/roles.tf
+++ b/roles.tf
@@ -5,7 +5,7 @@ module "patch_role" {
   role_name              = local.patch_role_name
   role_description       = format("Assumed by %v to execute patching operations on EC2 instances in target accounts", local.patch_execution_role_name)
   assume_policy_document = data.aws_iam_policy_document.patch_role_assume.json
-  attached_policies      = [aws_iam_policy.patch_role.arn]
+  attached_policies      = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_policy_name)]
 
   tags = local.tags_iam
 }
@@ -17,7 +17,7 @@ module "patch_execution_role" {
   role_name              = local.patch_execution_role_name
   role_description       = format("Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume %v in target accounts", local.patch_role_name)
   assume_policy_document = data.aws_iam_policy_document.patch_execution_role_assume.json
-  attached_policies      = [aws_iam_policy.patch_execution_role.arn]
+  attached_policies      = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_execution_policy_name)]
 
   tags = local.tags_iam
 }
@@ -31,7 +31,7 @@ module "patch_execproxy_role" {
   role_name               = local.patch_execproxy_role_name
   role_description        = format("Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of %v", local.patch_execution_role_name)
   assume_policy_document  = data.aws_iam_policy_document.patch_execproxy_role_assume.json
-  attached_policies       = [aws_iam_policy.patch_execproxy_role.arn]
+  attached_policies       = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_execproxy_policy_name)]
   enable_instance_profile = true
 
   tags = local.tags_iam