PolicySizeExceeded policy config_error ai_generated partial

Error: Policy size limit exceeded. Maximum policy size is 256KB. The policy size is 300KB.

ID: policy/gcp-iam-policy-size-exceeded

Also available as: JSON · Markdown · 中文
80%Fix Rate
85%Confidence
1Evidence
2023-11-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
GCP IAM v1 active — — —
Google Cloud SDK 450.0.0 active — — —
Terraform Google Provider v5.0.0 active — — —

Root Cause

The IAM policy attached to a GCP resource (project, service account, or bucket) exceeds the 256KB hard limit, often due to too many bindings or long condition expressions.

generic

中文

附加到 GCP 资源（项目、服务账号或存储桶）的 IAM 策略超过了 256KB 的硬性限制，通常是由于绑定过多或条件表达式过长。

Official Documentation

https://cloud.google.com/iam/quotas

Workarounds

  1. 85% success Split the policy into multiple smaller policies attached to different resources (e.g., separate project-level and folder-level policies): gcloud projects add-iam-policy-binding PROJECT_ID --member='user:[email protected]' --role='roles/viewer' gcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:[email protected]' --role='roles/viewer' 
    Split the policy into multiple smaller policies attached to different resources (e.g., separate project-level and folder-level policies):

gcloud projects add-iam-policy-binding PROJECT_ID --member='user:[email protected]' --role='roles/viewer'
gcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:[email protected]' --role='roles/viewer'
  2. 80% success Use groups instead of individual members to reduce the number of bindings: create a Google Group and add members to it, then grant the role to the group. 
    Use groups instead of individual members to reduce the number of bindings: create a Google Group and add members to it, then grant the role to the group.

中文步骤

  1. 将策略拆分为多个较小的策略，附加到不同的资源（例如，单独的项目级和文件夹级策略）：

gcloud projects add-iam-policy-binding PROJECT_ID --member='user:[email protected]' --role='roles/viewer'
gcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:[email protected]' --role='roles/viewer'
  2. 使用群组代替单个成员以减少绑定数量：创建一个 Google 群组并将成员添加到其中，然后将角色授予该群组。

Dead Ends

Common approaches that don't work:

  1. Removing all condition expressions from bindings to reduce size 50% fail

    May remove necessary access controls, and the total policy size may still exceed the limit if there are many bindings.

  2. Using a single binding with a large list of members 60% fail

    Doesn't reduce policy size significantly; the binding still counts toward the total size.

  3. Requesting a quota increase from GCP support 90% fail

    The 256KB limit is a hard limit that cannot be increased; you must restructure the policy.