Confused about IAM Roles, Policies, Statements and Actions

Question

The Cloudformation documentation describes the following relationships between the parts of an IAM Role specification:

Service (Lambda in my case)
  has one or more 
Role/s
  which contain one or more
Policy/ies
  which contain a
Policy Document
  which contains one or more
Statement/s
  which contains one or more
{Effect,[Action],Resource} objects
  which specify one or more
Action/s

Suppose I want to give a [Role] permission to do an [Action]. How do I determine where in the above hierarchy the permission should be specified?

In my specific case, I want to add s3:GetObject to a role for a Lambda.

Should I

• create a new Role?
• create a new Policy in an existing Role?
• add a new statement to an existing Policy?
• add a new Action to an existing Statement (using Resource:'*') ?

Looking for guidance as to when each of the above would apply...

Answer 1

I guess you can do any of the following, the only requirement being your policy document for that role must contain the statement

s3:GetObject