Choosing between managed policies and inline policies

A single managed policy can be attached to multiple principal entities (users, groups, and roles). You can create a library of policies that define useful permissions for your Amazon Web Services account, and then attach these policies to principal entities as needed.

When you change a managed policy, the change is applied to all principal entities that the policy is attached to. For example, if you want to add permission for a new Amazon API, you can update a customer managed policy or associate an Amazon managed policy to add the permission. If you're using an Amazon managed policy, Amazon updates the policy. When a managed policy is updated, the changes are applied to all principal entities that the managed policy is attached to. In contrast, to change an inline policy, you must individually edit each identity that contains the inline policy. For example, if a group and a role both contain the same inline policy, you must individually edit both principal entities to change that policy.

When you change a customer managed policy, the changed policy doesn't overwrite the existing policy. Instead, IAM creates a new version of the managed policy. IAM stores up to five versions of your customer managed policies. You can use policy versions to revert a policy to an earlier version as needed.

You can allow users in your Amazon Web Services account to attach and detach policies while maintaining control over the permissions defined in those policies. To do this, designate some users as full administrators—that is, administrators that can create, update, and delete policies. You can then designate other users as limited administrators. Those limited administrators can attach policies to other principal entities, but only the policies that you have allowed them to attach.

For more information about delegating permissions management, see Controlling access to policies.

The maximum character size limit for managed policies is greater than the character limit for inline policies. If you reach the inline policy's character size limit, you can create more IAM groups and attach the managed policy to the group.

For more information on quotas and limits, see IAM and Amazon STS quotas.

Amazon maintains Amazon managed policies and updates them when necessary, for example, to add permissions for new Amazon services, without you having to make changes. The updates are automatically applied to the principal entities that you have attached the Amazon managed policy to.