# Error: Policy size limit exceeded. Maximum policy size is 256KB. The policy size is 300KB.

- **ID:** `policy/gcp-iam-policy-size-exceeded`
- **Domain:** policy
- **Category:** config_error
- **Error Code:** `PolicySizeExceeded`
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

The IAM policy attached to a GCP resource (project, service account, or bucket) exceeds the 256KB hard limit, often due to too many bindings or long condition expressions.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| GCP IAM v1 | active | — | — |
| Google Cloud SDK 450.0.0 | active | — | — |
| Terraform Google Provider v5.0.0 | active | — | — |

## Workarounds

1. **Split the policy into multiple smaller policies attached to different resources (e.g., separate project-level and folder-level policies):

gcloud projects add-iam-policy-binding PROJECT_ID --member='user:alice@example.com' --role='roles/viewer'
gcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:bob@example.com' --role='roles/viewer'** (85% success)
   ```
   Split the policy into multiple smaller policies attached to different resources (e.g., separate project-level and folder-level policies):

gcloud projects add-iam-policy-binding PROJECT_ID --member='user:alice@example.com' --role='roles/viewer'
gcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:bob@example.com' --role='roles/viewer'
   ```
2. **Use groups instead of individual members to reduce the number of bindings: create a Google Group and add members to it, then grant the role to the group.** (80% success)
   ```
   Use groups instead of individual members to reduce the number of bindings: create a Google Group and add members to it, then grant the role to the group.
   ```

## Dead Ends

- **Removing all condition expressions from bindings to reduce size** — May remove necessary access controls, and the total policy size may still exceed the limit if there are many bindings. (50% fail)
- **Using a single binding with a large list of members** — Doesn't reduce policy size significantly; the binding still counts toward the total size. (60% fail)
- **Requesting a quota increase from GCP support** — The 256KB limit is a hard limit that cannot be increased; you must restructure the policy. (90% fail)