Skip to content
ENExplore Calculators

AWS IAM Policy Calculator

Measure a role against the default AWS IAM quotas: policy characters, 10 managed attachments, and account role and policy limits.

About AWS IAM Policy Calculator

AWS enforces IAM limits at three levels at once: the size of each document, the number of documents attached to a principal, and the number of objects in the account. A role can be well inside the character limit and still fail to deploy because it already has ten managed policies attached. These quotas surface as LimitExceeded errors during deployment rather than at design time, and the attachment limit in particular tends to bite exactly when an incident response needs one more policy attached.

Formulas

AWS IAM Policy

characters on the role = managed policies attached × characters each + aggregate inline characters, each measured against its own quota.

10
Default managed policies attachable to one principal
6144
Character limit for one managed policy
10240
Aggregate inline policy limit on a role

Default AWS account quotas

Account quotas: 1500 customer managed policies, 1000 roles, 5000 users, 300 groups, 5 versions per managed policy.

5 versions
Older versions must be deleted before a sixth can be created

Worked example

With the default values below, AWS IAM Policy Calculator returns Total Policy Characters on the Role of 32,600. Change any input above and every figure here is recalculated in your browser.

Inputs used

Managed policies attached to the roleaccepts 0–40 policies
7 policies
Characters in the largest managed policyaccepts 1–12,000 characters
4,200 characters
Aggregate inline policy characters on the roleaccepts 0–20,000 characters
3,200 characters
Customer managed policies in the accountaccepts 0–5,000 policies
640 policies
IAM roles in the accountaccepts 0–10,000 roles
480 roles

Results

Total Policy Characters on the Role
32,600 characters
Managed Attachments Remaining
3 of 10
Managed Policy Size vs 6144
68.4%
Inline Policy Size vs 10240
31.3%
Customer Managed Policies vs 1500
42.7%
Roles vs 1000 per Account
48.0%
Assessment
Within all default IAM quotas

Step by step

  1. 1Values used
  2. 2AWS IAM Policy
  3. 3Default AWS account quotas
  4. 4Total Policy Characters on the Role= 32,600 characters
  5. 5Managed Attachments Remaining= 3 of 10
  6. 6Managed Policy Size vs 6144= 68.4
  7. 7Inline Policy Size vs 10240= 31.3
  8. 8Customer Managed Policies vs 1500= 42.7
  9. 9Roles vs 1000 per Account= 48.0

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is AWS IAM Policy calculated?

characters on the role = managed policies attached × characters each + aggregate inline characters, each measured against its own quota. AWS enforces IAM limits at three levels at once: the size of each document, the number of documents attached to a principal, and the number of objects in the account. A role can be well inside the character limit and still fail to deploy because it already has ten managed policies attached.

Why does AWS IAM Policy matter?

These quotas surface as LimitExceeded errors during deployment rather than at design time, and the attachment limit in particular tends to bite exactly when an incident response needs one more policy attached.

What values do I need to enter?

This calculator takes 5 inputs: Managed policies attached to the role, Characters in the largest managed policy, Aggregate inline policy characters on the role, Customer managed policies in the account, IAM roles in the account. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Which AWS IAM limits can be raised?

The managed policies per principal quota can go from 10 to 20, and roles per account, customer managed policies per account and users per account are adjustable through Service Quotas. The character limits on policy documents and the 5-versions-per-policy limit are hard and cannot be raised.

Do permissions boundaries and SCPs count against these limits?

A permissions boundary is a managed policy, so it consumes a document with its own 6144-character limit, but it does not consume one of the ten attachment slots. Service control policies live in AWS Organizations with separate limits and do not count against the account's IAM policy quotas at all.

Related Calculators

AWS IAM Policy Calculator | Calcrivo