IAM Policy Size Checker

IAM enforces separate character-count quotas depending on how a policy document is attached — a managed policy, a role's inline policy, a user's inline policy, or a group's inline policy each has its own limit, and exceeding it produces a rejection at attach time rather than a warning while you are still editing. IAM Policy Size Checker paste your policy JSON once and shows exactly where it stands against all four limits at the same time, since the same document is often reused across more than one attachment type.

The four limits checked are the standard published AWS IAM quotas: a customer-managed policy is capped at 6,144 characters, a role's inline policy at 10,240 characters, a user's inline policy at 2,048 characters, and a group's inline policy at 5,120 characters. Because a single JSON document could plausibly be attached as any of these — the same read-only S3 policy might start life as a user inline policy and later get promoted to a managed policy shared across a team — this tool does not guess which one you mean. It shows a pass/fail result against all four, each with the limit, whether your document is currently over or under it, and by exactly how many characters it exceeds the limit when it fails.

The character count itself follows how AWS actually measures it, which surprises people the first time they see it: whitespace used purely for formatting — the indentation, the newlines between statements, the spaces around colons in a pretty-printed document — does not count against the quota. AWS strips whitespace before measuring, so a policy formatted for human readability with two-space indentation is not penalized relative to the same policy minified onto one line. This tool reports both numbers: the character count exactly as typed or pasted (what you would get from counting the raw text), and the whitespace-excluded count that AWS actually measures against the quota. All four limit comparisons use the whitespace-excluded count, since that is what determines whether AWS accepts or rejects the policy.

This is deliberately a narrow, single-purpose size calculator. It does not validate the JSON structure beyond what is needed to measure it (a JSON parse error is reported plainly, with no attempt at line/column diagnosis — the separate IAM Policy JSON Syntax Validator tool in this category handles that in depth), it does not check for overly permissive statements, duplicate statements, or wildcard usage (each of those has its own dedicated tool here too), and it does not call any AWS API to confirm the current quota values — the four numbers are the standard published limits as of this writing. If you are near a limit, the practical next steps are usually to consolidate statements that share the same Resource or Principal into fewer statements with combined Action arrays (cutting repeated JSON structural overhead), remove unused Sid values or comments-as-strings, or split one oversized document into more than one smaller policy attached separately — none of which this tool does automatically, but knowing the precise overage in characters makes it obvious how much trimming is actually needed rather than guessing.

Everything runs locally in your browser the moment you paste or click a sample; nothing is uploaded or sent to any server.

• All 4 IAM size limits checked at once — managed policy, role inline, user inline, group inline.
• Whitespace-excluded character count, matching exactly how AWS measures policy size.
• Raw (as-typed) character count shown alongside for reference.
• Pass/fail per limit, with the exact overage in characters when a limit is exceeded.
• No assumption about which attachment type you intend — see all four results together.
• Works on minified or pretty-printed JSON identically, since the whitespace-excluded count is used for comparisons.
• Sample multi-statement policy to see the check in action immediately.
• Clear JSON parse errors if the pasted text is not valid JSON.
• 100% client-side — nothing is uploaded.

1. Paste your policy JSON, or click "Load sample".
2. Click Check size.
3. Read the whitespace-excluded character count shown prominently at the top.
4. Scan the 4-row limit table for a pass/fail per policy attachment type.
5. For any failing limit, note the exact overage in characters shown.
6. Trim, consolidate, or split the policy and re-check until it fits the limits you need.

Example 1 — small read-only policy. A single-statement S3 read policy comes in well under all four limits — passes across the board.

Example 2 — fits role inline, too big for user inline. A 15-statement policy with per-bucket Resource ARNs might land around 2,800 whitespace-excluded characters — over the 2,048 user inline limit by roughly 750 characters, but comfortably under the 5,120 group inline and 10,240 role inline limits.

Example 3 — too big even for a managed policy. A sprawling 60-statement policy generated by combining many services can exceed even the 6,144 managed policy limit — the fix is usually to split it into two or more smaller managed policies.

Example 4 — pretty-printed vs minified, same result. Pasting the same policy once indented with 2-space formatting and once minified onto a single line reports the identical whitespace-excluded count and identical pass/fail results, since formatting whitespace is excluded from the AWS-measured count.

Example 5 — right at the edge. A document whose whitespace-excluded count lands at exactly 2,048 characters passes the user inline limit (the limit is inclusive); one character more and it fails, reported as "over by 1 character."

• Checks all 4 real IAM quotas in one paste, no need to know which one applies.
• Matches AWS's exact measurement — whitespace excluded, not raw character count.
• Shows precise overage, not just pass/fail, so you know how much to cut.
• Catches size problems before AWS rejects the policy at attach time.
• Instant, local feedback — no waiting on an API call.
• Private — policy content never leaves your browser.