IAM Quota & Limits Reference

IAM enforces dozens of numeric quotas — how many roles an account can hold, how many managed policies can attach to one role, how large a policy document can be, how long a role session can last — and they are scattered across AWS's documentation with no single at-a-glance table. IAM Quota & Limits Reference is a searchable table of the commonly-cited AWS IAM default quotas, each explicitly labeled as either adjustable via the Service Quotas console or a fixed hard limit that cannot be raised by any request.

That adjustable-vs-hard-limit distinction matters more than the raw numbers themselves. Quotas like roles per account (1,000), users per account (5,000), groups per account (300), customer-managed policies per account (1,500), and managed policies attached per role/user/group (10) are all defaults that AWS commonly allows raising through a Service Quotas request — an account that has been running a while may already be operating well above the published default for several of these. Other numbers are hard limits no request can move: the 6,144/10,240/2,048/5,120-character managed/role-inline/user-inline/group-inline policy size quotas, the 10-groups-per-user cap, the exactly-2-access-keys-per-user cap, the 5-versions-per-managed-policy cap, the 12-hour (43,200 second) maximum role session duration, and the separate 1-hour cap that applies specifically when a session is obtained through role chaining (using one assumed role's session to assume a second role).

Role and user name length (64 characters) and policy name length (128 characters) are included but marked approximate — worth double-checking against current AWS documentation rather than treated as certain. SAML and OIDC identity provider counts per account are included the same way, marked approximate, and only included because there is reasonable confidence in the figure, not certainty.

These are commonly-cited defaults that can and do change. AWS revises published quota values over time, and many are soft limits specific accounts may have already had increased. Verify current values in the AWS Service Quotas console before relying on any number shown here for capacity planning or an actual deployment decision.

• ~19 commonly-cited AWS IAM default quotas in one searchable table.
• Adjustable (Service Quotas) vs. hard-limit labeling on every row.
• Approximate figures flagged explicitly (name-length limits, federation provider counts) rather than stated with false confidence.
• Covers roles, users, groups, policies, and federation quotas together.
• Live search/filter across category, item, value, and note.
• Visible disclaimer to verify current values in the AWS Service Quotas console.
• 100% client-side.

1. Browse or search the table (e.g. "session", "policy size", "groups").
2. Check the Adjustable? column to know whether a Service Quotas request could raise that specific number.
3. Note any row marked approximate and double-check it against current AWS documentation if precision matters.
4. Verify in the AWS Service Quotas console before relying on any figure for a real decision.

Example 1 — planning a large account. Search "per account" to see the account-wide caps (roles, users, groups, managed policies) that AWS commonly allows raising.

Example 2 — hitting an attach error. Search "attached" to find the 10-managed-policies-per-role/user default quota that a failed AttachRolePolicy call likely just hit.

Example 3 — session duration confusion. Search "session" to see both the 12-hour role session cap and the separate 1-hour role-chaining cap side by side.

Example 4 — policy sizing. Search "size" to see all four inline/managed policy character limits together.

• One table instead of scattered documentation pages.
• Honest adjustable-vs-hard-limit labeling, not a flat list that implies everything can be raised.
• Approximate figures flagged, not stated with false precision.
• Searchable for fast lookup.
• Repeated verification reminder given how often AWS quotas change.
• Private — runs entirely in your browser.