An IAM user has hit the quota for attached managed policies. What is the right way to grant the remaining permissions?
Show answer and explanation
Answer: B
IAM caps how many managed policies one identity can carry, so stacking more attachments is not an option. The durable fix is to merge related permissions into a smaller number of customer managed policies, which is easier to review and stays under the limit, and to assign those policies to a group or role that many identities share. Users then inherit permissions through membership rather than accumulating attachments of their own.
Why the other options are wrong
- A. Deleting all policies revokes access across the account and breaks every workload that depends on them.
- C. Splitting a workload across more users multiplies credentials and does not reduce the number of policies any one of them needs.
- D. The root account should not be used for routine work, and its credentials cannot substitute for normal identity permissions.
Exam tip. When IAM policy quotas bite, consolidate policies and attach them to groups or roles.