IAM and STS limits that cause failures, and how to read the live values
Fixed name and size limits that make IAM and STS calls fail (stated here because they cannot be changed), and the calls that read adjustable quotas live.
markdownreferencev4T0ZN-E6JSstage: referencetrust: officialservice: iamservice: stsinterface: cliIAM quotasSTS quotascharacter limitsrole name lengthpolicy sizemanaged policies per rolesession duration
IAM and STS limits
Two kinds of limit, handled differently. Fixed limits (name lengths, policy sizes, session parameters) cannot be raised, so they are stated below. Adjustable quotas (how many roles, policies per role, and so on) change by account and over time, so this document gives the calls that read them; it never states their values.
Read the adjustable quotas live
Account-level IAM usage and quota values:
aws iam get-account-summaryAWS default values for a service's quotas (these do not reflect increases granted to the account):
aws service-quotas list-aws-default-service-quotas --service-code <code>Applied values for this account use aws service-quotas list-service-quotas --service-code <code>. The service code for IAM was not confirmed in the collected sources; list the codes with aws service-quotas list-services (UNVERIFIED command name; check aws service-quotas help). IAM quota increases are requested in Service Quotas with the Region set to US East (N. Virginia); requests up to each quota's listed maximum are approved automatically.
Adjustable IAM quotas include customer managed policies per account, groups per account, instance profiles per account, managed policies per role, per user and per group, role trust policy length, roles per account, server certificates and OpenID Connect providers per account.
Recent change: the default for managed policies per role was raised in August 2026 and applies automatically to existing roles. Any tutorial, template comment or older document that states the earlier default is out of date; read the live value.
The STS requests-per-second quota is per account and per Region, shared across AssumeRole, GetCallerIdentity, GetSessionToken, GetFederationToken, GetAccessKeyInfo and DecodeAuthorizationMessage. It is raised through AWS Support, not Service Quotas.
Fixed limits
These cannot be increased. The exact error text for each was not collected; if you hold one, search the hub for it and file a drift report if nothing matches.
Names
| Object | Limit |
|---|---|
| User name | 64 characters |
| Role name | 64 characters; if the role is used with Switch Role in the console, path plus role name together must fit in 64 |
| Group, policy, instance profile name | 128 characters |
| Path | 512 characters; must begin and end with / |
| Account alias | 3–63 characters, lowercase, DNS-style, no leading/trailing or doubled hyphen, not a 12-digit number |
User, group, role, policy, instance profile and path names allow letters, digits and +=,.@_-. User, group, role and instance profile names are unique per account without regard to case: Admins and admins collide.
Policy documents
| Item | Limit |
|---|---|
| Allowed characters | tab, line feed, carriage return, and U+0020–U+00FF |
| Customer managed policy | 6,144 characters each |
| Inline policies, total per user | 2,048 characters |
| Inline policies, total per role | 10,240 characters |
| Inline policies, total per group | 5,120 characters |
White space is not counted toward these sizes. Inline policy names cannot contain \ / * ? or white space.
Sessions (STS)
| Item | Limit |
|---|---|
| Role session name | 2–64 characters, letters, digits and +=,.@- |
| Session duration | 900 seconds up to the role's maximum (1–12 hours); default one hour |
| Role chaining | session capped at one hour |
| Session policies | one inline JSON policy plus up to 10 managed policy ARNs, 2,048 characters combined |
| Session tags | up to 50; key 128 characters, value 256 |
| External ID | 2–1,224 characters |
| SAML assertion (base64) | 100,000 characters |
Session policies and session tags also count against a separate packed session-token size limit, which can fail with PackedPolicyTooLarge even when each limit above is met. Check SessionTokenUtilization in the AssumeRole response.
Tags on IAM resources
Key up to 128 characters, value up to 256 (values may be empty).
Where these failures are explained
- Error text and fixes:
reference/iam/errors.md,reference/sts/errors.md. - Session parameters in context:
reference/sts/assume-role.md.