CODEWITHSUNDEEP
amazon-web-servicesterraformamazon-iam
Miantian
Miantian

Reputation: 1075

How to fix LimitExceeded issue in AWS with terraform?

When I run a terraform apply, got this error:

running "...terraform apply" in ".../aws-config": exit status 1
module.aws_config_role.aws_iam_policy.default: Modifying... [id=arn:aws:iam::10391031030:policy/my-aws-config-role]

Error: Error updating IAM policy arn:aws:iam::10391031030:policy/my-aws-config-role: LimitExceeded: Cannot exceed quota for PolicySize: 6144
    status code: 409, request id: 313b0l20-a29d-0121-la32-01210d0103c01

In fact this task will update the IAM policy and add many new items, knows from terraform plan:

~ update in-place

Terraform will perform the following actions:

  # module.aws_config_role.aws_iam_policy.default will be updated in-place
~ resource "aws_iam_policy" "default" {
        arn    = "arn:aws:iam::10391031030:policy/my-aws-config-role"
        id     = "arn:aws:iam::10391031030:policy/my-aws-config-role"
        name   = "my-aws-config-role"
        path   = "/"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action   = [
                            "..." // old
                            "..." // old
                            "..." // old
                          + "..." // new
                          + "..." // new
                          + "..." // new
                          + "..." // new
                          + "..." // new
                          ...

 Plan: 0 to add, 1 to change, 0 to destroy.

After an aws provider version upgrade, got this change. How to avoid it? Ignore this task or is it possible to extend AWS' plicy size?

Upvotes: 9

Views: 16173

Answers (1)

Marcin
Marcin

Reputation: 238687

The limit of 6144 characters for a managed policy is from AWS, not TF. So you have to fix/workaround it from AWS perspective, not TF.

You can follow official AWS recommendations:

Upvotes: 10

Related Questions