GCP IAM Policy Size Calculator

policy bytes ≈ principals × (principal length + 4) + bindings × (role length + 10 + structural overhead) + conditional bindings × (expression length + 60) + audit configs × entry size. An allow policy is a JSON document, so its size is dominated by the longest repeated strings: principal identifiers. Because every principal appears in full inside every binding that grants it a role, adding one person to twelve roles adds twelve copies of a 60-character string, which is why group-based bindings shrink policies so effectively.

Hitting the policy size or principal limit fails an access request at exactly the wrong moment, and the fix — collapsing individuals into groups or moving shared grants up to a folder — is a redesign rather than a quick edit. Confirm the current limits for your resource type in the IAM quotas documentation, since they differ between projects, folders and organisations.

This calculator takes 11 inputs: Role bindings in the policy, Principals per binding, Average principal string length, Average role name length, Bindings with an IAM condition, Average condition expression length, Structural bytes per binding, Policy size limit, Principal limit per policy, Audit config entries, Bytes per audit config entry. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

A condition is stored as a CEL expression plus a title and description on the binding itself, so a few hundred bytes each. A policy with dozens of finely scoped conditional bindings can spend more of its byte budget on conditions than on principals.