LimitExceeded policy resource_error ai_generated true

Error: Error putting IAM policy: LimitExceeded: Cannot exceed quota for PolicySize: 6144

ID: policy/aws-iam-policy-size-exceeded

Also available as: JSON · Markdown · 中文
80%Fix Rate
86%Confidence
1Evidence
2024-03-05First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
AWS IAM API 2010-05-08 active — — —
AWS CLI v2.15.0 active — — —
Terraform AWS Provider v5.40.0 active — — —

Root Cause

AWS IAM policy size limit is 6144 characters for customer managed policies; the policy document exceeds this due to too many statements, long ARNs, or verbose conditions.

generic

中文

AWS IAM 策略大小限制为客户管理策略 6144 个字符；策略文档因语句过多、ARN 过长或条件冗长而超出此限制。

Official Documentation

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-entity

Workarounds

  1. 80% success Consolidate multiple statements with overlapping actions into a single statement using a list of actions and resources. For example, combine 's3:GetObject' and 's3:PutObject' into one statement with 's3:GetObject', 's3:PutObject'. 
    Consolidate multiple statements with overlapping actions into a single statement using a list of actions and resources. For example, combine 's3:GetObject' and 's3:PutObject' into one statement with 's3:GetObject', 's3:PutObject'.
  2. 75% success Use policy variables like ${aws:username} to reduce hardcoded ARN length, and remove redundant conditions. 
    Use policy variables like ${aws:username} to reduce hardcoded ARN length, and remove redundant conditions.
  3. 85% success Split the policy into multiple managed policies attached to the same role; each managed policy has its own 6144 character limit. 
    Split the policy into multiple managed policies attached to the same role; each managed policy has its own 6144 character limit.

中文步骤

  1. 将具有重叠操作的多个语句合并为一个语句，使用操作和资源列表。例如，将 's3:GetObject' 和 's3:PutObject' 合并为一个语句，包含 's3:GetObject', 's3:PutObject'。
  2. 使用策略变量如 ${aws:username} 减少硬编码 ARN 长度，并删除冗余条件。
  3. 将策略拆分为多个托管策略附加到同一角色；每个托管策略有自己的 6144 字符限制。

Dead Ends

Common approaches that don't work:

  1. 90% fail

    Removing whitespace or minifying JSON does not reduce the character count significantly; the error is about logical size, not formatting.

  2. 70% fail

    Splitting the policy into multiple inline policies on the same role still counts toward the total role policy size limit (10240 characters).

  3. 50% fail

    Using a wildcard instead of listing individual resources may violate least-privilege policies and still hit size limits if the condition is verbose.