def ensure_role(client, role_name):
    """
    Ensures that a SINGLE matching IAM role exists. Throws a `RuntimeError` if there are multiple
    matching roles.

    :param client: The iam client to use.
    :param role_name: The name of the IAM role.
    :return: The ARN of the matching IAM role, or `None` if there was no matching role.
    """
    roles = client.list_roles(PathPrefix="/")["Roles"]
    matching_roles = [it for it in roles if it["RoleName"] == role_name]
    if len(matching_roles) == 1:
        return matching_roles[0]["Arn"]
    elif len(matching_roles) > 1:
        raise RuntimeError("Found multiple matching roles: {}".format(role_name, roles))
    else:
        return None