SAM Doctor

ERROR REFERENCE

An IAM role reached its managed-policy attachment quota

Cannot exceed quota for PoliciesPerRole: 10

IAM rejected attaching another managed policy to a role. The quoted number is the account's applied PoliciesPerRole quota and can vary; it is adjustable, unlike the hard inline-policy document-size limit.

WHAT IT MEANS

What this error means

An error occurred (LimitExceeded) when calling the AttachRolePolicy operation:
Cannot exceed quota for PoliciesPerRole: 10

CREATE_FAILED AWS::IAM::Role MyRole Resource handler returned message:
"Cannot exceed quota for PoliciesPerRole: 10 (Service: Iam, Status Code: 409)"
(HandlerErrorCode: ServiceLimitExceeded)

Attaching one more managed policy would take the role past its allowance. This is the attachment-count limit, not the document-size limit for a single policy and not the aggregate inline-policy size limit.

SAFE NEXT STEPS

Confirm the role and account before changing permissions

  1. Name the role and its current attachments. 
    aws iam list-attached-role-policies --role-name YOUR_ROLE
  2. Confirm the applied quota. 
    aws iam get-account-summary --query "SummaryMap.AttachedPoliciesPerRoleQuota" --output text
  3. Remove an attachment only after confirming it is obsolete. Check who owns each policy before detaching; do not detach policies blindly to make the error go away.
  4. Consolidate policies deliberately. Merge only when the combined policy stays least-privilege and reviewable. Do not broaden actions or resources just to lower the attachment count.
  5. When every attachment is intentional, request an increase. PoliciesPerRole is an adjustable quota. File the increase through Service Quotas; IAM's quota guide directs these requests through US East (N. Virginia).

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes direct IAM attachment failures and matching CloudFormation resource events, keeps unrelated failed resources visible, and runs locally without AWS credentials or log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED