SAM Doctor

ERROR REFERENCE

An IAM role's inline policies exceed the aggregate size limit

Maximum policy size of 10240 bytes exceeded for role

IAM rejected the combined inline-policy content on one role. This is a hard per-role limit, not the size limit for one customer-managed policy and not the adjustable count of managed-policy attachments.

WHAT IT MEANS

What this error means

An error occurred (LimitExceeded) when calling the PutRolePolicy operation:
Maximum policy size of 10240 bytes exceeded for the role my-function-role

CREATE_FAILED AWS::IAM::Policy FunctionPolicy Maximum policy size of 10240 bytes
exceeded for role my-function-role (Service: AmazonIdentityManagement; Status Code: 409)

IAM limits the aggregate character content of every inline policy on a role to 10,240 characters, excluding whitespace. The policy named in the last failed event may only be the one that crossed the threshold.

SAFE NEXT STEPS

Inspect the full role before changing permissions

  1. Start with the generated deployment artifact. Inspect the synthesized or packaged template and list every inline policy it will put on the role; do not assume the final resource is the whole cause.
  2. Inventory an existing role with read-only calls. 
    aws iam get-account-summary --query "SummaryMap.RolePolicySizeQuota" --output text
aws iam list-role-policies --role-name YOUR_ROLE
aws iam get-role-policy --role-name YOUR_ROLE --policy-name YOUR_INLINE_POLICY
  3. Make bounded reductions. Remove duplicate statements and repeated resources while preserving the intended permissions. Move a genuinely reusable policy to a customer-managed policy only when that makes ownership clearer.
  4. Keep the related quotas separate. A customer-managed policy still has its own document-size limit, and role attachments have their own adjustable PoliciesPerRole quota.
  5. Do not broaden the policy to make it shorter. Avoid replacing specific actions or resources with wildcards, and do not request a quota increase: the aggregate inline-policy limit is hard.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes direct IAM failures and matching CloudFormation resource events, keeps unrelated failed resources visible, and runs locally without AWS credentials or log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED