View a markdown version of this page

Policy size per resource - Amazon Verified Permissions
How policy sizes are calculatedStaying within the quotaTemplate-linked policy size example

Policy size per resource

Verified Permissions limits the total size of all policies that reference the same resource. This limit is the Policy size per resource quota, and its default value is 200,000 bytes. When you call CreatePolicy or UpdatePolicy, Verified Permissions calculates the new total for the referenced resource. If the new total exceeds the quota, the request fails with a ServiceQuotaExceededException.

Policies that don't specify a resource apply to all resources. These policies share a separate total for the "unspecified" resource, which is limited to the same quota value.

For the list of all Verified Permissions quotas, see Quotas for Amazon Verified Permissions.

How policy sizes are calculated

Each policy contributes to the total for a resource as follows:

  • Static policies – A static policy contributes its full size. This is the same value that is measured against the Policy size quota.

  • Template-linked policies – A template-linked policy contributes the combined length of the principal and resource used to instantiate it. If you don't specify the principal or resource, its length is counted as 0. The size of the policy template body itself doesn't count toward this quota.

Each policy also adds a fixed overhead of up to a few hundred bytes to the total. Template-linked policies add more overhead than static policies.

Staying within the quota

If your application approaches the Policy size per resource quota, consider the following strategies:

  • Use the appropriate policy type. If many policies grant similar permissions on the same resource, policy templates might reduce your policy store's storage consumption. Each template-linked policy stores only its principal and resource. The policy template stores the shared statement once, but each linked policy also carries a fixed storage overhead. Templates only pay for themselves when the shared statement is large enough to offset that overhead, roughly 200 bytes or more. Below that threshold, individual static policies consume less space. For more information, see Amazon Verified Permissions policy templates and template-linked policies.

  • Specify principals and resources in the policy scope. Policies that don't specify a resource share a single total for the "unspecified" resource across the policy store. Scoping each policy to a specific resource spreads your policies across separate totals, one for each resource.

  • Group your principals and resources. Instead of writing a policy for each principal, write a policy for a group and add principals to the group. Grouping resources into containers can similarly reduce the number of policies that reference a single resource.

  • Request a quota increase. You can request an increase to this quota if your policy design meets certain constraints. To qualify, your policies must specify the principal or resource in the policy scope. An increase might also reduce the number of hierarchy parents that your principals and resources can have. Even with an increased quota, a 200,000-byte sub-limit still applies to policies that reference the same principal and the same resource. You cannot request an increase to this sub-limit.

Template-linked policy size example

To find how template-linked policies contribute to the Policy size per resource quota, add the length of the principal and the length of the resource. If you don't specify a resource, Verified Permissions counts its size toward the "unspecified" resource total.

Review the following template:

permit (
  principal in ?principal,
  action in
    [MyApplication::Action::"ContentManagement",
     MyApplication::Action::"AccountAdministration",
     MyApplication::Action::"BillingOperations"],
  resource in ?resource
)
when {
  resource has authorizedTenantIds &&
  principal has tenantId &&
  resource.authorizedTenantIds.contains(principal.tenantId)
};

Create the following policies from that template:

TemplateLinkedPolicy {
  policyId: "policy1",
  templateId: "template1",
  principal: User::"alice",
  resource: Photo::"car.jpg"
}

TemplateLinkedPolicy {
  policyId: "policy2",
  templateId: "template1",
  principal: User::"bob",
  resource: Photo::"boat.jpg"
}

TemplateLinkedPolicy {
  policyId: "policy3",
  templateId: "template1",
  principal: User::"jane",
  resource: Photo::"car.jpg"
}

TemplateLinkedPolicy {
  policyId: "policy4",
  templateId: "template1",
  principal: User::"jane",
  resource
}

Calculate the size of those policies by counting the bytes in the principal and resource for each one. Verified Permissions measures size in UTF-8 bytes. Characters in the printable ASCII range count as 1 byte each, but other characters can use more. The following examples use only ASCII characters, so each character counts as 1 byte. These calculations exclude the fixed overhead. Your actual totals will be higher.

The size of policy1 is the length of the principal User::"alice" (13) plus the length of the resource Photo::"car.jpg" (16). The total is 13 + 16 = 29 bytes.

The size of policy2 is the length of the principal User::"bob" (11) plus the length of the resource Photo::"boat.jpg" (17). The total is 11 + 17 = 28 bytes.

The size of policy3 is the length of the principal User::"jane" (12) plus the length of the resource Photo::"car.jpg" (16). The total is 12 + 16 = 28 bytes.

The size of policy4 is the length of the principal User::"jane" (12) plus the length of the resource (0). The total is 12 + 0 = 12 bytes.

Because policy2 is the only policy that references the resource Photo::"boat.jpg", the total resource size is 28 bytes.

Because policy1 and policy3 both reference the resource Photo::"car.jpg", the total resource size is 29 + 28 = 57 bytes.

Because policy4 is the only policy that references the "unspecified" resource, the total resource size is 12 bytes.