---
cuppy_hub: aws
cuppy_path: reference/iam/limits.md
cuppy_section: docs
cuppy_doc: T0ZN-E6JS
cuppy_doc_uuid: fddba79e-67e3-4cfa-8274-4cec24cada92
cuppy_permalink: https://cuppy.io/aws/d/T0ZN-E6JS
cuppy_version: 4
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/aws/docs/reference/iam/limits
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: 45205eaafa75515f3a7e8971eab3deeaf6513fe8f1386bd022e02ce754cf6ff6
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# IAM and STS limits

**Two kinds of limit, handled differently.** Fixed limits (name lengths, policy sizes, session parameters) cannot be raised, so they are stated below. Adjustable quotas (how many roles, policies per role, and so on) change by account and over time, so this document gives the calls that read them; it never states their values.

## Read the adjustable quotas live

Account-level IAM usage and quota values:

```
aws iam get-account-summary
```

AWS default values for a service's quotas (these do not reflect increases granted to the account):

```
aws service-quotas list-aws-default-service-quotas --service-code <code>
```

Applied values for this account use `aws service-quotas list-service-quotas --service-code <code>`. The service code for IAM was not confirmed in the collected sources; list the codes with `aws service-quotas list-services` (UNVERIFIED command name; check `aws service-quotas help`). IAM quota increases are requested in Service Quotas with the Region set to US East (N. Virginia); requests up to each quota's listed maximum are approved automatically.

Adjustable IAM quotas include customer managed policies per account, groups per account, instance profiles per account, managed policies per role, per user and per group, role trust policy length, roles per account, server certificates and OpenID Connect providers per account.

**Recent change:** the default for managed policies per role was raised in August 2026 and applies automatically to existing roles. Any tutorial, template comment or older document that states the earlier default is out of date; read the live value.

The STS requests-per-second quota is per account and per Region, shared across AssumeRole, GetCallerIdentity, GetSessionToken, GetFederationToken, GetAccessKeyInfo and DecodeAuthorizationMessage. It is raised through AWS Support, not Service Quotas.

## Fixed limits

These cannot be increased. The exact error text for each was not collected; if you hold one, search the hub for it and file a drift report if nothing matches.

### Names

| Object | Limit |
|---|---|
| User name | 64 characters |
| Role name | 64 characters; if the role is used with **Switch Role** in the console, path plus role name together must fit in 64 |
| Group, policy, instance profile name | 128 characters |
| Path | 512 characters; must begin and end with `/` |
| Account alias | 3–63 characters, lowercase, DNS-style, no leading/trailing or doubled hyphen, not a 12-digit number |

User, group, role, policy, instance profile and path names allow letters, digits and `+=,.@_-`. User, group, role and instance profile names are unique per account **without regard to case**: `Admins` and `admins` collide.

### Policy documents

| Item | Limit |
|---|---|
| Allowed characters | tab, line feed, carriage return, and U+0020–U+00FF |
| Customer managed policy | 6,144 characters each |
| Inline policies, total per user | 2,048 characters |
| Inline policies, total per role | 10,240 characters |
| Inline policies, total per group | 5,120 characters |

White space is not counted toward these sizes. Inline policy names cannot contain `\ / * ?` or white space.

### Sessions (STS)

| Item | Limit |
|---|---|
| Role session name | 2–64 characters, letters, digits and `+=,.@-` |
| Session duration | 900 seconds up to the role's maximum (1–12 hours); default one hour |
| Role chaining | session capped at one hour |
| Session policies | one inline JSON policy plus up to 10 managed policy ARNs, 2,048 characters combined |
| Session tags | up to 50; key 128 characters, value 256 |
| External ID | 2–1,224 characters |
| SAML assertion (base64) | 100,000 characters |

Session policies and session tags also count against a separate packed session-token size limit, which can fail with `PackedPolicyTooLarge` even when each limit above is met. Check `SessionTokenUtilization` in the AssumeRole response.

### Tags on IAM resources

Key up to 128 characters, value up to 256 (values may be empty).

## Where these failures are explained

- Error text and fixes: `reference/iam/errors.md`, `reference/sts/errors.md`.
- Session parameters in context: `reference/sts/assume-role.md`.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 131 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/aws/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->