I checked the managed policy limit expansion (20) for AWS IAM roles
This page has been translated by machine translation. View original
Introduction
On August 19, 2026, AWS announced that the default quota for managed policies that can be attached to an IAM role has been increased from 10 to 20.
This change is automatically applied to existing roles as well.
In this article, we will use the AWS CLI to verify the quota value and the actual number of policies that can be attached.
Verification
Quota Value
I retrieved the IAM account summary.
aws iam get-account-summary
From the response, I extracted only the relevant line.
{
"SummaryMap": {
...
"AttachedPoliciesPerRoleQuota": 20,
...
}
}
The number of managed policies that can be attached per role was 20.
The same value can also be confirmed from Service Quotas in Virginia.
aws service-quotas list-service-quotas --service-code iam --region us-east-1
The retrieved list included the following quota.
{
"ServiceCode": "iam",
"ServiceName": "AWS Identity and Access Management (IAM)",
"QuotaArn": "arn:aws:servicequotas::123456789012:iam/L-0DA4ABF3",
"QuotaCode": "L-0DA4ABF3",
"QuotaName": "Managed policies per role",
"Value": 20.0,
"Unit": "None",
"Adjustable": true,
"GlobalQuota": true,
"UsageMetric": {
"MetricNamespace": "AWS/Usage",
"MetricName": "ResourceCount",
"MetricDimensions": {
"Class": "None",
"Resource": "ManagedPoliciesPerRole",
"Service": "IAM",
"Type": "Resource"
},
"MetricStatisticRecommendation": "Maximum"
},
"Period": {
"PeriodValue": 5,
"PeriodUnit": "MINUTE"
},
"QuotaAppliedAtLevel": "ACCOUNT",
"QuotaContext": {
"ContextScope": "RESOURCE",
"ContextScopeType": "AWS::IAM::Role",
"ContextId": "*"
},
"Description": "The maximum number of IAM managed policies that you can attach to an IAM role."
},
The value for Managed policies per role was also 20. The AttachedPoliciesPerRoleQuota in the account summary and Managed policies per role in Service Quotas refer to the same quota. PoliciesPerRole, which appears in the error in the next section, is also the same.
Number of Attached Policies
We attach 21 AWS managed policies one by one to a newly created role for verification. We prepared 21 policies to confirm whether it stops at one over the limit.
aws iam attach-role-policy --role-name example-role --policy-arn <policy ARN>
Up to the 20th policy, AmazonRoute53ReadOnlyAccess, the operation succeeded, and at that point the following policies were attached to the role.
The order in the list follows the API return order and does not match the order in which they were attached.
20 AWS managed policies attached
{
"AttachedPolicies": [
{
"PolicyName": "AWSCloudFormationReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AWSCloudFormationReadOnlyAccess"
},
{
"PolicyName": "AmazonKinesisReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonKinesisReadOnlyAccess"
},
{
"PolicyName": "AmazonSNSReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess"
},
{
"PolicyName": "AmazonEC2ReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess"
},
{
"PolicyName": "AWSOrganizationsReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess"
},
{
"PolicyName": "AmazonECSTaskExecutionRolePolicy",
"PolicyArn": "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
},
{
"PolicyName": "AmazonSSMReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess"
},
{
"PolicyName": "CloudWatchReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess"
},
{
"PolicyName": "ReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/ReadOnlyAccess"
},
{
"PolicyName": "IAMReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/IAMReadOnlyAccess"
},
{
"PolicyName": "AmazonVPCReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess"
},
{
"PolicyName": "ViewOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"
},
{
"PolicyName": "AmazonRDSReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess"
},
{
"PolicyName": "SecurityAudit",
"PolicyArn": "arn:aws:iam::aws:policy/SecurityAudit"
},
{
"PolicyName": "AmazonAPIGatewayInvokeFullAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonAPIGatewayInvokeFullAccess"
},
{
"PolicyName": "AmazonDynamoDBReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess"
},
{
"PolicyName": "AmazonS3ReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
},
{
"PolicyName": "AmazonRoute53ReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonRoute53ReadOnlyAccess"
},
{
"PolicyName": "AmazonSQSReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AmazonSQSReadOnlyAccess"
},
{
"PolicyName": "AWSLambda_ReadOnlyAccess",
"PolicyArn": "arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess"
}
]
}
When specifying AmazonEventBridgeReadOnlyAccess as the 21st policy, the operation failed and the following error was returned.
aws: [ERROR]: An error occurred (LimitExceeded) when calling the AttachRolePolicy operation: Cannot exceed quota for PoliciesPerRole: 20
Summary
The default maximum number of managed policies that can be attached to an IAM role is now 20. For cases where the previous limit of 10 was not sufficient and a quota increase request had been submitted, that process should no longer be necessary.
A list of IAM quotas is available in the IAM User Guide.
You can request an increase up to a maximum of 25 through Service Quotas, but considering operational overhead, we recommend keeping usage within the default limit of 20.
