# 错误：策略大小超出限制。最大策略大小为 256KB。当前策略大小为 300KB。

- **ID:** `policy/gcp-iam-policy-size-exceeded`
- **领域:** policy
- **类别:** config_error
- **错误码:** `PolicySizeExceeded`
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

附加到 GCP 资源（项目、服务账号或存储桶）的 IAM 策略超过了 256KB 的硬性限制，通常是由于绑定过多或条件表达式过长。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| GCP IAM v1 | active | — | — |
| Google Cloud SDK 450.0.0 | active | — | — |
| Terraform Google Provider v5.0.0 | active | — | — |

## 解决方案

1. ```
   将策略拆分为多个较小的策略，附加到不同的资源（例如，单独的项目级和文件夹级策略）：

gcloud projects add-iam-policy-binding PROJECT_ID --member='user:alice@example.com' --role='roles/viewer'
gcloud resource-manager folders add-iam-policy-binding FOLDER_ID --member='user:bob@example.com' --role='roles/viewer'
   ```
2. ```
   使用群组代替单个成员以减少绑定数量：创建一个 Google 群组并将成员添加到其中，然后将角色授予该群组。
   ```

## 无效尝试

- **Removing all condition expressions from bindings to reduce size** — May remove necessary access controls, and the total policy size may still exceed the limit if there are many bindings. (50% 失败率)
- **Using a single binding with a large list of members** — Doesn't reduce policy size significantly; the binding still counts toward the total size. (60% 失败率)
- **Requesting a quota increase from GCP support** — The 256KB limit is a hard limit that cannot be increased; you must restructure the policy. (90% 失败率)