AWS verifiedpermissions documentation change

Service: verifiedpermissions · 2025-03-30 · Documentation low

File: verifiedpermissions/latest/userguide/quotas.md

Summary

Added detailed example explaining how template-linked policies contribute to policy size quotas

Security assessment

Change provides quota calculation examples but does not address security vulnerabilities or document security features

Diff

diff --git a/verifiedpermissions/latest/userguide/quotas.md b/verifiedpermissions/latest/userguide/quotas.md
index ab3c6ffb0..c5f1bbf9d 100644
--- a/verifiedpermissions/latest/userguide/quotas.md
+++ b/verifiedpermissions/latest/userguide/quotas.md
@@ -43,0 +44,63 @@ Policy size per resource | 200,000 bytes² | Yes | The maximum size of all polic
+### Template-linked policy size example
+
+You can determine how template-linked policies contribute to the _Policy size per resource_ quota by taking the sum of the length of the principal and resource. If the principal or resource isn't specified, the length of that piece is 0. If a resource isn't specified, its size counts towards the `"unspecified"` resource quota. The size of the template body itself has no impact on the policy size.
+
+Let's look at the following template:
+    
+    
+    @id("template1")
+    permit (
+      principal in ?principal,
+      action in [Action::"view", Action::"comment"], 
+      resource in ?resource
+    )
+    unless {
+      resource.tag =="private"
+    };
+
+Let's create the following policies from that template:
+    
+    
+    TemplateLinkedPolicy {
+      policyId: "policy1",
+      templateId: "template1",
+      principal: User::"alice",
+      resource: Photo::"car.jpg"
+    }
+    
+    TemplateLinkedPolicy {
+      policyId: "policy2",
+      templateId: "template1",
+      principal: User::"bob",
+      resource: Photo::"boat.jpg"
+    }
+    
+    TemplateLinkedPolicy {
+      policyId: "policy3",
+      templateId: "template1",
+      principal: User::"jane",
+      resource: Photo::"car.jpg"
+      
+    TemplateLinkedPolicy {
+      policyId: "policy4",
+      templateId: "template1",
+      principal: User::"jane",
+      resource
+    }
+
+Now, let's calculate the size of those policies by counting the characters in the `principal` and `resource` for each one. Each character counts as 1 byte.
+
+The size of `policy1` would be the length of the principal `User::"alice"` (13) plus the length of the resource `Photo::"car.jpg"` (16). Adding them up we have 13 + 16 = 29 bytes.
+
+The size of `policy2` would be the length of the principal `User::"bob"` (11) plus the length of the resource `Photo::"boat.jpg"` (17). Adding them up we have 11 + 17 = 28 bytes.
+
+The size of `policy3` would be the length of the principal `User::"jane"` (12) plus the length of the resource `Photo::"car.jpg"` (16). Adding them up we have 12 + 16 = 28 bytes.
+
+The size of `policy4` would be the length of the principal `User::"jane"` (12) plus the length of the resource (0). Adding them up we have 12 + 0 = 12 bytes.
+
+Since `policy2` is the only policy that references the resource `Photo::"boat.jpg"`, the total resource size is 28 bytes.
+
+Since `policy1` and `policy3` both reference the resource `Photo::"car.jpg"`, the total resource size is 29 + 28 = 57 bytes.
+
+Since `policy4` is the only policy that references the `"unspecified"` resource, the total resource size is 12 bytes.
+