PolicySizeExceeded policy config_error ai_generated partial

错误：策略大小超出限制。最大策略大小为 256KB。当前策略大小为 300KB。

Error: Policy size limit exceeded. Maximum policy size is 256KB. The policy size is 300KB.

ID: policy/gcp-iam-policy-size-exceeded

其他格式: JSON · Markdown 中文 · English
80%修复率
85%置信度
1证据数
2023-11-20首次发现

版本兼容性

版本状态引入弃用备注
GCP IAM v1 active — — —
Google Cloud SDK 450.0.0 active — — —
Terraform Google Provider v5.0.0 active — — —

根因分析

附加到 GCP 资源（项目、服务账号或存储桶）的 IAM 策略超过了 256KB 的硬性限制，通常是由于绑定过多或条件表达式过长。

English

The IAM policy attached to a GCP resource (project, service account, or bucket) exceeds the 256KB hard limit, often due to too many bindings or long condition expressions.

generic

官方文档

https://cloud.google.com/iam/quotas

解决方案

  1. 将策略拆分为多个较小的策略，附加到不同的资源（例如，单独的项目级和文件夹级策略）：

gcloud projects add-iam-policy-binding PROJECT_ID --member='user:[email protected]' --role='roles/viewer'
gcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:[email protected]' --role='roles/viewer'
  2. 使用群组代替单个成员以减少绑定数量：创建一个 Google 群组并将成员添加到其中，然后将角色授予该群组。

无效尝试

常见但无效的做法:

  1. Removing all condition expressions from bindings to reduce size 50% 失败

    May remove necessary access controls, and the total policy size may still exceed the limit if there are many bindings.

  2. Using a single binding with a large list of members 60% 失败

    Doesn't reduce policy size significantly; the binding still counts toward the total size.

  3. Requesting a quota increase from GCP support 90% 失败

    The 256KB limit is a hard limit that cannot be increased; you must restructure the policy.