AWS First Steps
New feature

AWS IAM now supports 20 managed policies per role by default

AWS IAM increases the default quota for managed policies per role from 10 to 20, reducing the need for service quota requests

AWS IAM has raised the default quota for managed policies per role from 10 to 20. This change reduces the need for service quota requests when following IAM best practices, such as separating permissions into purpose-specific policies, or when onboarding to AWS Partner products that require attaching additional managed policies. If more than 20 managed policies per role are needed, a quota increase up to 25 can be requested using Service Quotas. The update applies automatically to all IAM roles across all commercial AWS Regions, AWS GovCloud (US), and China Regions with no action required.

Why it matters

This change affects users managing IAM policies, particularly those needing to attach multiple policies to roles.

Read the original AWS announcement

Related articles and terms

AWS Service QuotasA service for centrally managing AWS service usage limits, submitting quota increase requests, and configuring alertsWhy AWS Service Quotas Exist - Multi-Tenant Design That Protects Shared InfrastructureExplain how AWS service quotas (formerly service limits) are not mere restrictions but a design to protect other customers in a multi-tenant environment, covering the noisy neighbor problem, soft vs hard limits, and what happens behind quota increase requests.AWS IAMAn authentication and authorization service for securely controlling access to AWS resources, providing fine-grained access management through users, groups, roles, and policiesDesigning Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.Detecting Excessive Permissions with IAM Access Analyzer - External Access and Unused Permission AnalysisDetect unused permissions on IAM roles using CloudTrail-based analysis and auto-generate least-privilege policies. This guide covers external access detection and integrating custom policy checks into your CI/CD pipeline.