{"record":{"id":"de266abf394399d2","repo":"kubernetes/kops","slug":"policy-size-was-d-policy-cannot-exceed-10240-byt","errorCode":null,"errorMessage":"policy size was %d. Policy cannot exceed 10240 bytes","messagePattern":"policy size was (.+?)\\. Policy cannot exceed 10240 bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go","lineNumber":301,"sourceCode":"\t\t}\n\t}\n\n\t// TODO: Should we use path as our tag?\n\treturn nil // No tags in IAM\n}\n\nfunc (e *IAMRolePolicy) policyDocumentString() (string, error) {\n\tif e.PolicyDocument == nil {\n\t\treturn \"\", nil\n\t}\n\n\tpolicy, err := fi.ResourceAsString(e.PolicyDocument)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tpolicySize := len(strings.Join(strings.Fields(policy), \"\"))\n\tif policySize > 10240 {\n\t\treturn \"\", fmt.Errorf(\"policy size was %d. Policy cannot exceed 10240 bytes\", policySize)\n\t}\n\treturn policy, err\n}\n\ntype terraformIAMRolePolicy struct {\n\tName           *string                  `cty:\"name\"`\n\tRole           *terraformWriter.Literal `cty:\"role\"`\n\tPolicyDocument *terraformWriter.Literal `cty:\"policy\"`\n\tPolicyArn      *string                  `cty:\"policy_arn\"`\n}\n\nfunc (_ *IAMRolePolicy) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMRolePolicy) error {\n\tif e.ExternalPolicies != nil && len(*e.ExternalPolicies) > 0 {\n\t\tfor _, policy := range *e.ExternalPolicies {\n\t\t\t// create a hash of the arn\n\t\t\th := fnv.New32a()\n\t\t\th.Write([]byte(policy))\n","sourceCodeStart":283,"sourceCodeEnd":319,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go#L283-L319","documentation":"policyDocumentString serializes the PolicyDocument resource to a string and enforces AWS's 10240-byte limit for inline role policies, counting only non-whitespace characters. If the compacted policy exceeds the limit it refuses to return it, so any caller (ShouldCreate, RenderAWS, RenderTerraform) surfaces this error. It is a client-side guard mirroring the AWS quota.","triggerScenarios":"Any apply or terraform render where the role's inline PolicyDocument, after stripping whitespace, is larger than 10240 bytes.","commonSituations":"Cluster specs with many additionalPolicies entries merged into one role policy; policies listing hundreds of ARNs; policy growth after kops upgrades adding new permissions.","solutions":["Reduce policy size: combine actions, use wildcards on resources where acceptable, remove unused statements.","Move permissions into an IAM managed policy and attach by ARN (10KB per managed policy, and larger quotas are available).","Check the reported byte count against your JSON and delete redundant statements.","For AWS-managed kops policies, upgrade/verify you are not duplicating statements across spec versions."],"exampleFix":"// before\n\"Resource\": [\"arn:aws:s3:::bucket/a\", \"arn:aws:s3:::bucket/b\", \"arn:aws:s3:::bucket/c\"]\n// after\n\"Resource\": \"arn:aws:s3:::bucket/*\"","handlingStrategy":"validation","validationCode":"policy, _ := fi.ResourceAsString(task.PolicyDocument)\nsize := len(strings.Join(strings.Fields(policy), \"\"))\nif size > 10240 {\n  return fmt.Errorf(\"refusing to apply: inline policy is %d bytes (limit 10240)\", size)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Audit additionalPolicies sizes in the cluster spec; split into managed policies when >8KB.","Combine actions with wildcards instead of enumerating hundreds of ARNs.","Add a CI check that compacts each policy JSON and asserts <10240 bytes.","Re-check size after every kops upgrade, since builtin policies grow."],"tags":["aws","iam","policy-size-limit","quota"],"backgroundTag":"iam-policy-too-large","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}