diff --git a/CHANGES.md b/CHANGELOG.md
similarity index 83%
rename from CHANGES.md
rename to CHANGELOG.md
index 806180a..4368dbb 100644
--- a/CHANGES.md
+++ b/CHANGELOG.md
@@ -27,3 +27,6 @@
 
 * v2.4.0 -- 20210405
   - use `ldap-get-attribute` to get email address
+
+* v2.5.0 -- 20210512
+  - add `attached_policies` to enable adding policies for an IAM account (generally, just services)
diff --git a/README.md b/README.md
index 22d4e1b..fedc8b7 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,9 @@ version.
 `roles`, `saml_role` and `create_access_keys` do not at this point do anything,
 though some effort is in progress to make access keys operational.
 
+You can only attach a policy if the `service_account` is true.  This example below will not fail,
+but it will not attach a policy to the user account.
+
 # Usage
 
 ```hcl
@@ -27,6 +30,7 @@ module "admin_user_bond0007" {
   pgp_key             = file("init/tf-gpg-key.b64")
   service_account     = false
   enable_sending_mail = false
+  attached_policies   = [ aws_iam_policy.mypolicy.arn ]
 
   # roles               = [ ]
   # saml_role          = [ "role-name" ]
@@ -54,6 +58,7 @@ No requirements.
 
 | Name | Type |
 |------|------|
+| [aws_iam_policy_attachment.user_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource |
 | [aws_iam_user.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user) | resource |
 | [aws_iam_user_group_membership.user_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_group_membership) | resource |
 | [aws_iam_user_login_profile.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_user_login_profile) | resource |
@@ -66,6 +71,7 @@ No requirements.
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
+| <a name="input_attached_policies"></a> [attached\_policies](#input\_attached\_policies) | List of IAM Policy ARNs to attach to this user (only for service accounts) | `list(string)` | `[]` | no |
 | <a name="input_create_access_keys"></a> [create\_access\_keys](#input\_create\_access\_keys) | Set to 1 or true to create access keys (not implemented) | `bool` | `false` | no |
 | <a name="input_email_address"></a> [email\_address](#input\_email\_address) | Email address for the user | `string` | n/a | yes |
 | <a name="input_enable_sending_mail"></a> [enable\_sending\_mail](#input\_enable\_sending\_mail) | Enable using email address for the user from SES | `bool` | `false` | no |
diff --git a/main.tf b/main.tf
index 7333f2c..3494da1 100644
--- a/main.tf
+++ b/main.tf
@@ -13,8 +13,10 @@
 * `roles`, `saml_role` and `create_access_keys` do not at this point do anything,
 * though some effort is in progress to make access keys operational.
 *
+* You can only attach a policy if the `service_account` is true.  This example below will not fail,
+* but it will not attach a policy to the user account.
+*
 * # Usage
-* 
 *
 * ```hcl
 * module "admin_user_bond0007" {
@@ -29,6 +31,7 @@
 *   pgp_key             = file("init/tf-gpg-key.b64")
 *   service_account     = false
 *   enable_sending_mail = false
+*   attached_policies   = [ aws_iam_policy.mypolicy.arn ]
 *
 *   # roles               = [ ]
 *   # saml_role          = [ "role-name" ]
@@ -44,6 +47,12 @@ locals {
   email_address     = var.email_address != "" ? lower(var.email_address) : module.user_email.search_result["attribute_value"][0]
   pgp_key_exists    = var.pgp_key != "" ? 1 : 0
   generate_password = var.generate_password ? local.pgp_key_exists : 0
+  ap1               = var.service_account ? var.attached_policies : []
+  ap2 = [for arn in local.ap1 : {
+    "policy" = arn
+    "parts"  = split("/", arn)
+  }]
+  attached_policies = { for v in local.ap2 : element(v.parts, length(v.parts) - 1) => v.policy }
   tags_username     = var.service_account ? map("boc:id:contact", local.username) : map("boc:id:username", local.username)
   tags_email = {
     "exists" = {
@@ -120,3 +129,11 @@ module "user_email" {
   filter    = "cn=${local.username}"
   attribute = "mail"
 }
+
+resource "aws_iam_policy_attachment" "user_policy" {
+  for_each   = local.attached_policies
+  name       = format("%v-attachment", each.key)
+  users      = aws_iam_user.user.user_name
+  policy_arn = each.value
+}
+
diff --git a/variables.tf b/variables.tf
index 1baefba..08775a9 100644
--- a/variables.tf
+++ b/variables.tf
@@ -76,3 +76,9 @@ variable "service_account" {
   type        = bool
   default     = false
 }
+
+variable "attached_policies" {
+  description = "List of IAM Policy ARNs to attach to this user (only for service accounts)"
+  type        = list(string)
+  default     = []
+}
diff --git a/version.tf b/version.tf
index f403a49..fca0743 100644
--- a/version.tf
+++ b/version.tf
@@ -1,3 +1,3 @@
 locals {
-  _module_version = "2.4.0"
+  _module_version = "2.5.0"
 }