LimitExceeded policy resource_error ai_generated true

错误：放置 IAM 策略时出错：LimitExceeded：不能超过 PolicySize 的配额：6144

Error: Error putting IAM policy: LimitExceeded: Cannot exceed quota for PolicySize: 6144

ID: policy/aws-iam-policy-size-exceeded

其他格式: JSON · Markdown 中文 · English
80%修复率
86%置信度
1证据数
2024-03-05首次发现

版本兼容性

版本状态引入弃用备注
AWS IAM API 2010-05-08 active — — —
AWS CLI v2.15.0 active — — —
Terraform AWS Provider v5.40.0 active — — —

根因分析

AWS IAM 策略大小限制为客户管理策略 6144 个字符；策略文档因语句过多、ARN 过长或条件冗长而超出此限制。

English

AWS IAM policy size limit is 6144 characters for customer managed policies; the policy document exceeds this due to too many statements, long ARNs, or verbose conditions.

generic

官方文档

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-entity

解决方案

  1. 将具有重叠操作的多个语句合并为一个语句，使用操作和资源列表。例如，将 's3:GetObject' 和 's3:PutObject' 合并为一个语句，包含 's3:GetObject', 's3:PutObject'。
  2. 使用策略变量如 ${aws:username} 减少硬编码 ARN 长度，并删除冗余条件。
  3. 将策略拆分为多个托管策略附加到同一角色；每个托管策略有自己的 6144 字符限制。

无效尝试

常见但无效的做法:

  1. 90% 失败

    Removing whitespace or minifying JSON does not reduce the character count significantly; the error is about logical size, not formatting.

  2. 70% 失败

    Splitting the policy into multiple inline policies on the same role still counts toward the total role policy size limit (10240 characters).

  3. 50% 失败

    Using a wildcard instead of listing individual resources may violate least-privilege policies and still hit size limits if the condition is verbose.