aws quota_error ai_generated true

An error occurred (LimitExceededException) when calling the PutRolePolicy: Cannot exceed quota for PolicySize

ID: aws/iam-policy-too-large

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
50Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
2 active — — —

Root Cause

IAM policy document exceeds 6,144 character limit (inline) or 10,240 (managed).

generic

Workarounds

  1. 92% success Split into multiple managed policies (up to 10 per role/user) 
    up to 10 per role/user

    Sources: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html

  2. 88% success Use wildcards to reduce statement count: s3:Get* instead of listing each action 
    s3:Get* instead of listing each action

    Sources: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_action.html

  3. 82% success Consolidate resources and conditions to reduce policy size 
    Merge multiple statements that share the same Effect and Action into one statement with a Resource array:
{
  "Effect": "Allow",
  "Action": ["s3:GetObject", "s3:PutObject"],
  "Resource": ["arn:aws:s3:::bucket-a/*", "arn:aws:s3:::bucket-b/*"]
}

Use resource wildcards where safe: arn:aws:s3:::my-app-*/* instead of listing each bucket. Remove duplicate or overlapping conditions.

    Sources: https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html

Dead Ends

Common approaches that don't work:

  1. Minify the JSON to reduce character count 60% fail

    Minor savings — the real issue is too many permissions

  2. Create multiple IAM users with split permissions 65% fail

    Complicates management and audit — use policy splitting instead

Error Chain

Frequently confused with: