{
  "id": "policy/gcp-iam-policy-size-exceeded",
  "signature": "Error: Policy size limit exceeded. Maximum policy size is 256KB. The policy size is 300KB.",
  "signature_zh": "错误：策略大小超出限制。最大策略大小为 256KB。当前策略大小为 300KB。",
  "regex": "Policy size limit exceeded.*Maximum policy size is \\d+KB.*The policy size is \\d+KB",
  "domain": "policy",
  "category": "config_error",
  "subcategory": null,
  "root_cause": "The IAM policy attached to a GCP resource (project, service account, or bucket) exceeds the 256KB hard limit, often due to too many bindings or long condition expressions.",
  "root_cause_type": "generic",
  "root_cause_zh": "附加到 GCP 资源（项目、服务账号或存储桶）的 IAM 策略超过了 256KB 的硬性限制，通常是由于绑定过多或条件表达式过长。",
  "versions": [
    {
      "version": "GCP IAM v1",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Google Cloud SDK 450.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Terraform Google Provider v5.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Removing all condition expressions from bindings to reduce size",
      "why_fails": "May remove necessary access controls, and the total policy size may still exceed the limit if there are many bindings.",
      "fail_rate": 0.5,
      "condition": "",
      "sources": []
    },
    {
      "action": "Using a single binding with a large list of members",
      "why_fails": "Doesn't reduce policy size significantly; the binding still counts toward the total size.",
      "fail_rate": 0.6,
      "condition": "",
      "sources": []
    },
    {
      "action": "Requesting a quota increase from GCP support",
      "why_fails": "The 256KB limit is a hard limit that cannot be increased; you must restructure the policy.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Split the policy into multiple smaller policies attached to different resources (e.g., separate project-level and folder-level policies):\n\ngcloud projects add-iam-policy-binding PROJECT_ID --member='user:alice@example.com' --role='roles/viewer'\ngcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:bob@example.com' --role='roles/viewer'",
      "success_rate": 0.85,
      "how": "Split the policy into multiple smaller policies attached to different resources (e.g., separate project-level and folder-level policies):\n\ngcloud projects add-iam-policy-binding PROJECT_ID --member='user:alice@example.com' --role='roles/viewer'\ngcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:bob@example.com' --role='roles/viewer'",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use groups instead of individual members to reduce the number of bindings: create a Google Group and add members to it, then grant the role to the group.",
      "success_rate": 0.8,
      "how": "Use groups instead of individual members to reduce the number of bindings: create a Google Group and add members to it, then grant the role to the group.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "将策略拆分为多个较小的策略，附加到不同的资源（例如，单独的项目级和文件夹级策略）：\n\ngcloud projects add-iam-policy-binding PROJECT_ID --member='user:alice@example.com' --role='roles/viewer'\ngcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:bob@example.com' --role='roles/viewer'",
    "使用群组代替单个成员以减少绑定数量：创建一个 Google 群组并将成员添加到其中，然后将角色授予该群组。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://cloud.google.com/iam/quotas",
  "official_doc_section": null,
  "error_code": "PolicySizeExceeded",
  "verification_tier": "ai_generated",
  "confidence": 0.85,
  "fix_success_rate": 0.8,
  "resolvable": "partial",
  "first_seen": "2023-11-20",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}