kubernetes/kops · error

policy size was %d. Policy cannot exceed 10240 bytes

Error message

policy size was %d. Policy cannot exceed 10240 bytes

What it means

policyDocumentString serializes the PolicyDocument resource to a string and enforces AWS's 10240-byte limit for inline role policies, counting only non-whitespace characters. If the compacted policy exceeds the limit it refuses to return it, so any caller (ShouldCreate, RenderAWS, RenderTerraform) surfaces this error. It is a client-side guard mirroring the AWS quota.

Source

Thrown at upup/pkg/fi/cloudup/awstasks/iamrolepolicy.go:301

		}
	}

	// TODO: Should we use path as our tag?
	return nil // No tags in IAM
}

func (e *IAMRolePolicy) policyDocumentString() (string, error) {
	if e.PolicyDocument == nil {
		return "", nil
	}

	policy, err := fi.ResourceAsString(e.PolicyDocument)
	if err != nil {
		return "", err
	}
	policySize := len(strings.Join(strings.Fields(policy), ""))
	if policySize > 10240 {
		return "", fmt.Errorf("policy size was %d. Policy cannot exceed 10240 bytes", policySize)
	}
	return policy, err
}

type terraformIAMRolePolicy struct {
	Name           *string                  `cty:"name"`
	Role           *terraformWriter.Literal `cty:"role"`
	PolicyDocument *terraformWriter.Literal `cty:"policy"`
	PolicyArn      *string                  `cty:"policy_arn"`
}

func (_ *IAMRolePolicy) RenderTerraform(t *terraform.TerraformTarget, a, e, changes *IAMRolePolicy) error {
	if e.ExternalPolicies != nil && len(*e.ExternalPolicies) > 0 {
		for _, policy := range *e.ExternalPolicies {
			// create a hash of the arn
			h := fnv.New32a()
			h.Write([]byte(policy))

View on GitHub (pinned to 4c8573c808)

Solutions

1. Reduce policy size: combine actions, use wildcards on resources where acceptable, remove unused statements.
2. Move permissions into an IAM managed policy and attach by ARN (10KB per managed policy, and larger quotas are available).
3. Check the reported byte count against your JSON and delete redundant statements.
4. For AWS-managed kops policies, upgrade/verify you are not duplicating statements across spec versions.

Example fix

// before
"Resource": ["arn:aws:s3:::bucket/a", "arn:aws:s3:::bucket/b", "arn:aws:s3:::bucket/c"]
// after
"Resource": "arn:aws:s3:::bucket/*"

policy, _ := fi.ResourceAsString(task.PolicyDocument)
size := len(strings.Join(strings.Fields(policy), ""))
if size > 10240 {
  return fmt.Errorf("refusing to apply: inline policy is %d bytes (limit 10240)", size)
}

When it happens

Trigger: Any apply or terraform render where the role's inline PolicyDocument, after stripping whitespace, is larger than 10240 bytes.

Common situations: Cluster specs with many additionalPolicies entries merged into one role policy; policies listing hundreds of ARNs; policy growth after kops upgrades adding new permissions.

Related errors

• IP version is incorrect
• provider ID cannot be empty
• provider ID number cannot be empty
• error listing hosted zones: %w
• arn %q has unrecognized type

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/de266abf394399d2. Report an issue: GitHub.