AWS IAM Policy Size Limit Exceeded: 7 Fixes + Calculator

The "PolicySizeLimitExceeded" error in AWS IAM means your managed policy exceeds 6,144 characters—and the real problem isn't just size, it's that your permissions have outgrown a single document. This guide breaks down the exact limits, provides a policy size calculator to estimate your current usage, shows 7 proven optimization techniques with before/after code examples, and reveals the enterprise-level strategies AWS doesn't document publicly.

Understanding IAM Policy Limits: The Math Nobody Teaches You

AWS enforces strict character limits on IAM policies for performance and reliability reasons. Understanding the exact math helps you diagnose and fix oversized policies—before they break your deployment.

IAM Policy Size Calculator: Estimate Your Current Usage

Paste your policy JSON below to get an instant size analysis, including optimization suggestions:

7 Proven Optimization Techniques (With Before/After Examples)

1. Action Wildcard Optimization: The 40% Space Saver

The most common cause of oversized policies is inefficient action formatting. This single optimization can reduce policy size by 30-40%.

2. Statement Consolidation: Merge Similar Statements

Multiple statements with similar actions and resources can often be combined into a single statement, saving the overhead of duplicate "Effect" and "Action" fields.

Before (3 statements, 423 characters):

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

After (1 statement, 285 characters):

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Savings: 138 characters (33% reduction)

3. Resource Optimization: Use Wildcards Strategically

Overly specific resource ARNs can bloat policies. Consider whether wildcards can safely replace specific resources.

1. Analyze your resource patterns: Do you need access to all S3 buckets, or just specific prefixes?
2. Use resource-level wildcards: arn:aws:s3:::my-bucket/* vs arn:aws:s3:::my-bucket
3. Consider bucket-level vs object-level permissions: arn:aws:s3:::my-bucket/* covers all objects in the bucket

Example: Multiple bucket access

Before (listing specific buckets):

"Resource": [
  "arn:aws:s3:::prod-bucket-1/*",
  "arn:aws:s3:::prod-bucket-2/*",
  "arn:aws:s3:::prod-bucket-3/*",
  "arn:aws:s3:::prod-bucket-4/*",
  "arn:aws:s3:::prod-bucket-5/*"
]

After (using pattern):

"Resource": "arn:aws:s3:::prod-bucket-*/*"

4. Policy Splitting: Divide and Conquer

For very large policies, splitting into multiple managed policies is often the best solution. This is where the "managed policy math" comes in.

5. Variable Reuse in Terraform/CloudFormation

If you're using IaC tools, you can define variables for repeated patterns and reference them in multiple places.

# Terraform example with reusable variables
variable "common_s3_actions" {
  default = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
}

variable "common_resources" {
  default = "arn:aws:s3:::my-bucket/*"
}

resource "aws_iam_policy" "s3_access" {
  name = "s3-access-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = var.common_s3_actions
        Resource = var.common_resources
      }
    ]
  })
}

# Reuse in another policy
resource "aws_iam_policy" "backup_policy" {
  name = "backup-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = var.common_s3_actions
        Resource = "arn:aws:s3:::backup-bucket/*"
      }
    ]
  })
}

6. Remove Redundant Permissions

Audit your policy for permissions that are no longer needed. Use IAM Access Analyzer to identify unused permissions.

1. Generate an IAM policy from access activity: Use the aws iam generate-service-last-accessed-details command
2. Remove unused actions: If an action hasn't been used in 90 days, consider removing it
3. Review resource access: Do you still need access to that S3 bucket you created last year?

7. Request a Quota Increase (Last Resort)

If you've optimized everything and still need more space, you can request an increase for managed policies.

1. Go to AWS Support Center
2. Create a case for "IAM quotas"
3. Request increase from 6,144 to 10,240 characters
4. Provide justification (e.g., "We have a complex enterprise policy with 50+ statements that cannot be logically split")

Advanced Techniques for Enterprise Policies

1. ABAC (Attribute-Based Access Control): The Future of IAM

AWS is increasingly recommending ABAC over traditional RBAC. ABAC uses tags to determine access, which can dramatically reduce policy size for large organizations.

2. Permissions Boundaries: Limit the Maximum Available Permissions

Use permissions boundaries to limit the maximum permissions that can be granted, which can help control policy size indirectly.

3. Policy as Code: Reusable Modules

For organizations with many policies, create reusable Terraform modules or CloudFormation templates.

Real-World Optimization Scenarios: Before and After

Scenario 1: The 8,500-Character Enterprise Policy

A Fortune 500 company had a single policy with 8,500 characters granting access to 25 S3 buckets and 15 EC2 actions.

Optimization applied:

1. Split into 3 managed policies based on functional areas (S3 access, EC2 access, monitoring)
2. Used action wildcards: s3:Get* instead of 12 individual actions
3. Consolidated 15 statements to 8 statements

Result: 3 policies averaging 2,800 characters each (16% total reduction)

Scenario 2: The Terraform-Generated Monster

A DevOps team's Terraform code generated policies with duplicate resource ARNs and verbose action lists.

Optimization applied:

1. Introduced Terraform variables for common patterns
2. Removed 40% of redundant permissions identified by IAM Access Analyzer
3. Consolidated duplicate resource ARNs

Result: Policy reduced from 7,200 to 4,100 characters (43% reduction)

Scenario 3: The Multi-Environment Deployment

A startup needed different permissions for dev, staging, and production environments but was hitting size limits.

Optimization applied:

1. Implemented ABAC with environment tags
2. Used a single policy with conditions instead of three separate policies

Result: Three 5,000-character policies replaced with one 1,200-character policy (76% reduction)

The Diagnostic Flowchart: Find Your Optimization Path

Update, October 2026: the exact IAM limits, corrected, and a better way to measure policy size

Readers pointed out that some limits in the table above needed tightening, and AWS has changed one quota since this guide was written. These are the figures to rely on, and they take precedence over anything above that differs.

Two corrections matter most. First, the 6,144-character size of a single managed policy cannot be increased; what can be increased is how many managed policies you attach to a role or user, which is why splitting a large policy into several managed policies, technique 4 above, is the standard fix. Second, inline limits are not one number: they depend on whether the inline policies are on a user, group or role, and they are cumulative across all inline policies on that identity, not per policy.

Whitespace does not count, so measure the minified size

IAM ignores whitespace when it counts a policy's characters. Counting the pretty-printed JSON with wc -c therefore overstates the size, sometimes by a third. Minify first with jq:

aws iam get-policy-version --policy-arn ARN --version-id v1 --query PolicyVersion.Document --output json | jq -c . | wc -c

The jq -c step removes whitespace, giving a figure close to what IAM counts. A policy that seemed to be at 7,000 characters may actually be under the limit, and the error may come from something else, such as a new statement pushing it over.

The other error messages people confuse with this one

LimitExceeded: Cannot exceed quota for PoliciesPerRole means too many managed policies are attached, not that one is too large; request a higher quota in Service Quotas or combine policies. LimitExceeded: Cannot exceed quota for ACLSizePerRole refers to the role's trust policy, the one limit that can be raised to 4,096 characters. And errors in IAM Identity Center permission sets have their own size rules for the combined inline policy, so the same splitting into customer managed policies applies there. Our guide to MalformedPolicyDocument errors covers the syntax errors that sometimes appear alongside size problems.

Use IAM Access Analyzer to shrink policies safely

Removing unused permissions is the cleanest way to cut size, and IAM Access Analyzer can generate a policy based on the actions a role actually used, from CloudTrail activity, and reports unused permissions on roles and users. Starting from a generated policy and adding back only what is genuinely needed often halves a policy's size while improving security. Last accessed information on each role, in the IAM console's Access Advisor tab, shows which services were not used recently.

For teams using infrastructure as code

In Terraform and CloudFormation, generate policies from data sources or modules that merge statements by service, and add a size check to your pipeline so oversized policies fail in review rather than at deployment. Keeping one managed policy per service area, such as storage, compute and logging, makes splitting predictable and keeps each document well under the limit.

More questions readers asked in 2026

Can I increase the 6,144-character managed policy limit?

No. Split the policy into several managed policies and, if needed, raise the number of managed policies per role in Service Quotas.

Does IAM count spaces in policy size?

No. Whitespace is not counted, so measure the minified JSON with jq -c.

What is the inline policy limit for an IAM role?

10,240 characters in total across all inline policies on the role. Users have 2,048 and groups 5,120.

How many managed policies can I attach to a role?

Up to 25 with a quota increase. Check Service Quotas for your account's current default.

Update added October 3, 2026. Where the figures above differ from earlier sections, these are current.

Frequently Asked Questions

1. What's the exact character limit for IAM policies?

Managed policies: 6,144 characters (default, can request increase to 10,240). Inline policies: 10,240 characters (fixed, cannot increase).

2. How do I check my current policy size?

Use the AWS CLI: aws iam get-policy-version --policy-arn ARN --version-id v1 | jq '.PolicyVersion.Document' | wc -c, or use the calculator above.

3. Can I increase the character limit for inline policies?

No. The inline policy limit is fixed at 10,240 characters. Only managed policies can be increased to 10,240 characters.

4. What's the most effective way to reduce policy size?

Action optimization using wildcards can reduce policy size by 30-40%. Consolidating statements can save another 10-15%. Combined, these two techniques often reduce policies by 40-55%.

5. Can I split a large policy into multiple managed policies?

Yes, and this is the recommended approach for very large policies. You can attach up to 10 managed policies by default (25 with quota increase).

6. How do I calculate how many policies I need?

Divide your total permissions by logical groupings (e.g., S3 access, EC2 access, monitoring). Aim for 2-4 policies per role, each under 6,144 characters.

7. What's the difference between a managed policy and an inline policy?

Managed policies are standalone policies attached to multiple identities. Inline policies are embedded directly in a single user, group, or role.

8. Can I use wildcards in resource ARNs?

Yes, but be cautious. arn:aws:s3:::bucket/* grants access to all objects in the bucket, while arn:aws:s3:::bucket grants bucket-level permissions.

9. How do I optimize policies in Terraform?

Use variables for common patterns, remove duplicate resources, and consolidate statements. Consider creating reusable policy modules.

10. What's the best way to handle very complex permissions?

Split into multiple managed policies based on functional areas (S3 access, EC2 access, etc.). This makes policies easier to manage and audit.

11. Can I use ABAC to reduce policy size?

Yes, ABAC can dramatically reduce policy size for large organizations. Instead of listing resources, use tags to determine access. A 100-resource policy can drop from 3,500 to 800 characters.

12. How do I audit for unused permissions?

Use IAM Access Analyzer's policy generation feature: aws iam generate-service-last-accessed-details

13. What's the default quota for managed policies per user?

The default is 10 managed policies per user, role, or group. You can request an increase to 20 (users) or 25 (roles).

14. How do I request a policy size increase?

Create an AWS Support case for "IAM quotas" and request an increase from 6,144 to 10,240 characters for managed policies. AWS rarely approves these without demonstrated need.

15. Can I use conditions to reduce policy size?

Yes, conditions can replace multiple resource-specific statements. For example, use a tag condition instead of listing every resource.

16. What's the maximum size for a trust policy?

Trust policies are limited to 10,240 characters. They follow the same optimization principles as identity policies.

Conclusion: Mastering the Policy Math

The PolicySizeLimitExceeded error isn't just a technical limitation—it's a design signal that your permissions might be more complex than they need to be. By mastering the character math and optimization techniques, you can create policies that are both powerful and efficient.

Remember the core principles: use action wildcards strategically, consolidate statements, split policies logically, and audit for unused permissions. With these techniques, you can keep your policies under the 6,144 character limit while maintaining all necessary permissions.

Revision note. Written September 2026. AWS occasionally updates quota values, so always check the official IAM quotas documentation for the latest limits. If you've been fighting this error, remember that you're not alone—policy size limits are a common challenge, but with the calculator and techniques in this guide, you can create policies that are both comprehensive and efficient.