IAM: Maximum policy size of 10240 bytes exceeded for role..

What is the problem?

Our app has a lot of resources (mostly a lot of secrets). This is causing the auto-generated inline policy max combined size to be exceeded. Even though this bug is technically covered by this feature request since using Managed Policies is probably the primary fix, I thought I should formally file this issue.

Reproduction Steps

Grant a lot of permissions to a resource that exceeds a total of 10240 bytes.

What did you expect to happen?

Policy consolidation, see this feature request, or the use of managed policies enables more than 10240 of policies.

What actually happened?

CloudFormation error: Maximum policy size of 10240 bytes exceeded for role...

CDK CLI Version

2.7.0 (build cfb09d5)

Framework Version

No response

Node.js Version

16.13.1

OS

Mac OS 12.1

Language

Python

Language Version

No response

Possible solutions:

https://github.com/aws/aws-cdk/issues/7448 https://github.com/aws/aws-cdk/issues/18458

[automartin5000]

@automartin5000 I’ve run into this same issue (also with secrets). Have you figured out a scalable solution to this?

Nothing scalable. Just realized I was adding the secrets to the task role (which already had a bunch of policies) when they’re only needed on the execution role. That made both role policies small enough for now.

If I hit the limit again, I’ll probably strip all the secrets out of the task definition, grant the task permissions to get secrets on <env>/*, and make the task retrieve the secrets itself.

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.