def _role_matches(client, role, role_document, policy_arn):
    """Does the given role data structure have the given policy document
    and the given policy ARN attached?

    (Roles can have up to two policy ARNs attached, but we don't need this
    functionality.)
    """
    if role['AssumeRolePolicyDocument'] != role_document:
        return False
    policy_resp = client.list_attached_role_policies(RoleName=role['RoleName'])
    policies = policy_resp['AttachedPolicies']
    return len(policies) == 1 and policies[0]['PolicyArn'] == policy_arn
