AWS IAM Policy Calculator

characters on the role = managed policies attached × characters each + aggregate inline characters, each measured against its own quota. AWS enforces IAM limits at three levels at once: the size of each document, the number of documents attached to a principal, and the number of objects in the account. A role can be well inside the character limit and still fail to deploy because it already has ten managed policies attached.

These quotas surface as LimitExceeded errors during deployment rather than at design time, and the attachment limit in particular tends to bite exactly when an incident response needs one more policy attached.

This calculator takes 5 inputs: Managed policies attached to the role, Characters in the largest managed policy, Aggregate inline policy characters on the role, Customer managed policies in the account, IAM roles in the account. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

The managed policies per principal quota can go from 10 to 20, and roles per account, customer managed policies per account and users per account are adjustable through Service Quotas. The character limits on policy documents and the 5-versions-per-policy limit are hard and cannot be raised.

A permissions boundary is a managed policy, so it consumes a document with its own 6144-character limit, but it does not consume one of the ten attachment slots. Service control policies live in AWS Organizations with separate limits and do not count against the account's IAM policy quotas at all.