diff --git a/controlpanel/api/models/app.py b/controlpanel/api/models/app.py
index 88359206f..288d53811 100644
--- a/controlpanel/api/models/app.py
+++ b/controlpanel/api/models/app.py
@@ -79,6 +79,10 @@ def _repo_name(self):
     def release_name(self):
         return webapp_release_name(self._repo_name)
 
+    @property
+    def iam_role_arn(self):
+        return cluster.iam_arn(f"role/{self.iam_role_name}")
+
     def get_group_id(self, env_name):
         return self.get_auth_client(env_name).get("group_id")
 
diff --git a/tests/api/models/test_app.py b/tests/api/models/test_app.py
index 3d81825ff..c9132c5b0 100644
--- a/tests/api/models/test_app.py
+++ b/tests/api/models/test_app.py
@@ -204,3 +204,8 @@ def test_app_allowed_ip_ranges():
     full_app_ip_ranges = app.app_allowed_ip_ranges
     assert " " not in full_app_ip_ranges
     assert len(full_app_ip_ranges.split(",")) == 4
+
+
+def test_iam_role_arn():
+    app = App(slug="example-app")
+    assert app.iam_role_arn == f"arn:aws:iam::{settings.AWS_DATA_ACCOUNT_ID}:role/test_app_example-app"