LimitExceededException aws resource_error ai_generated true

An error occurred (LimitExceededException) when calling the PutResourcePolicy operation: Resource policy limit reached for log group

ID: aws/cloudwatch-logs-resource-policy-limit

Also available as: JSON · Markdown · 中文
85%Fix Rate
84%Confidence
1Evidence
2024-03-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
cloudwatch-logs-2024 active — — —
aws-cli-2.16.0 active — — —

Root Cause

CloudWatch Logs resource policy size exceeds the 5120 character limit per account per region.

generic

中文

CloudWatch Logs资源策略大小超过每个账户每个区域5120字符的限制。

Official Documentation

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-access-control-overview-cwl.html

Workarounds

  1. 90% success List existing resource policies and remove unnecessary ones: aws logs describe-resource-policies. Then delete unused policies: aws logs delete-resource-policy --policy-name oldpolicy. Ensure total policy characters across all policies ≤ 5120. 
    List existing resource policies and remove unnecessary ones: aws logs describe-resource-policies. Then delete unused policies: aws logs delete-resource-policy --policy-name oldpolicy. Ensure total policy characters across all policies ≤ 5120.
  2. 85% success Consolidate multiple resource policies into one by combining statements in a single policy document. Example: create a new policy with multiple statements using PutResourcePolicy. 
    Consolidate multiple resource policies into one by combining statements in a single policy document. Example: create a new policy with multiple statements using PutResourcePolicy.

中文步骤

  1. List existing resource policies and remove unnecessary ones: aws logs describe-resource-policies. Then delete unused policies: aws logs delete-resource-policy --policy-name oldpolicy. Ensure total policy characters across all policies ≤ 5120.
  2. Consolidate multiple resource policies into one by combining statements in a single policy document. Example: create a new policy with multiple statements using PutResourcePolicy.

Dead Ends

Common approaches that don't work:

  1. 100% fail

    删除日志组不会影响账户级别的资源策略限制。

  2. 100% fail

    更改保留期与资源策略配额无关。