Size an IAM policy document against its character limit and see how many statements still fit before you must split it.
The document overhead covers the Version element and the outer JSON wrapper, then each statement contributes its Sid, Effect, Action, Resource and Condition characters. Dividing the remaining budget by the average statement length tells you how many more statements the same document can hold. Policy character limits are hard quotas: a deploy that pushes a policy one character over the limit fails with LimitExceeded, usually in the middle of a change window.
IAM Policy Size
policy size = statements × characters per statement + document overhead, and utilisation = size ÷ the limit for that policy type.
AWS IAM character limits
Managed policy 6144 characters; aggregate inline policy 2048 (user), 5120 (group), 10240 (role).
policy size = statements × characters per statement + document overhead, and utilisation = size ÷ the limit for that policy type. The document overhead covers the Version element and the outer JSON wrapper, then each statement contributes its Sid, Effect, Action, Resource and Condition characters. Dividing the remaining budget by the average statement length tells you how many more statements the same document can hold.
Policy character limits are hard quotas: a deploy that pushes a policy one character over the limit fails with LimitExceeded, usually in the middle of a change window.
This calculator takes 4 inputs: Statements in the policy, Average characters per statement, Policy type and its character limit, Whitespace you could strip. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
No. AWS states that whitespace is not counted when it measures a policy against the character limit, so pretty-printing your JSON is free. Everything else — Sids, long ARNs, condition keys — does count, which is why the minified figure here is a floor rather than the number AWS enforces.
Split it across several managed policies (up to 10 can attach to one role by default, raisable to 20), replace enumerated resource ARNs with wildcards or paths, drop Sid strings, and move repeated conditions into a permissions boundary or SCP instead of duplicating them per statement.