What we know is that we started to have increasing amounts of "policy is too big" errors in AWS APIs. Not IAM APIs. But things like Sagemaker being unable to st

What we know is that we started to have increasing amounts of "policy is too big" errors in AWS APIs. Not IAM APIs. But things like Sagemaker being unable to start an EC2 instance because the networking system couldn't evaluate IAM policy (the error messages were annoying in both being quite specific and not helpful ultimately). The computational complexity of the policies wasn't high (in fact, they were pretty much key-value things, as the only time we had something more complex was in AssumeRoleUsingWebIdentity calls - btw, that API sucks, embarassingly so - everything else was plain list of what a role could access).