Repository navigation
Four [limits] keys are accepted and not read or enforced #538
Description
Four [limits] keys are accepted by the configuration loader and documented, and the server does not act on them.
max_policy_document_bytes(crates/core/src/limits/mod.rs) has no reader. The policy document size check isPolicyDocument::from_json, which callsfrom_json_with_size_limit(json, 6_144)with a literal (crates/auth/src/policy/document.rs:157); both callers usefrom_json. Changing the key changes nothing.max_tables_per_accountis read only by the console settings page.CreateTable(crates/engine/src/create_table.rs) does not count the account's tables, so the limit is never enforced.per_table_max_rcuandper_table_max_wcuare read only byDescribeLimits(crates/engine/src/describe_limits.rs), which reports them. Provisioned throughput validation (crates/core/src/validation/mod.rs) checks that each value is at least 1 and has no upper bound, soCreateTableandUpdateTableaccept any value.
The configuration reference (#537) now describes each key as it behaves. This issue is the other half: either wire the keys (pass max_policy_document_bytes into from_json_with_size_limit on the write and read paths; count tables in CreateTable; bound provisioned throughput in validation) or remove them from LimitsConfig so an operator cannot set a limit that does nothing. The service rejects a table count above the account quota with LimitExceededException and a provisioned value above the per-table maximum with ValidationException; the messages are measured before any enforcement is written.
Found while checking every configuration key against the code that reads it, for #494.
Activity
LeeroyHannigan commentedon Oct 31, 2026
Measured on Amazon DynamoDB on 2026-10-31 between 22:30 and 22:34 UTC in us-east-1, each request twice with the same answer. Every request was refused; no table was created or changed.
On the account used, DescribeLimits reports a table maximum and an account maximum of 150,000 RCU and 200,000 WCU each, and the account had 61 RCU and 46 WCU reserved.
LimitExceededException:The requested ReadCapacityUnits, 150001, is above the per table maximum for the account in us-east-1. Per table maximum: 150000. Refer to the Amazon DynamoDB Developer Guide for current limits and how to request higher limits.WriteCapacityUnits, 200001andPer table maximum: 200000LimitExceededException:This request would have caused the ReadCapacityUnits limit to be exceeded for the account in us-east-1. Current ReadCapacityUnits reserved by the account: 61. Limit: 150000. Requested: 150001. Refer to the Amazon DynamoDB Developer Guide for current limits and how to request higher limits.WriteCapacityUnits,reserved by the account: 46,Limit: 200000andRequested: 200001Createat 150,001 RCU, on a table with 1 RCULimitExceededException:This request would have caused the ReadCapacityUnits limit to be exceeded for the account in us-east-1. Current ReadCapacityUnits reserved by the account: 61. Limit: 150000. Current ReadCapacityUnits provisioned for the table and indexes: 1. Requested: 150002. Refer to the Amazon DynamoDB Developer Guide for current limits and how to request higher limits.46,200000,1and200002ResourceInUseException:Table already exists: <name>ValidationException:One or more parameter values were invalid: Some index key attributes are not defined in AttributeDefinitions. Keys: [pk], AttributeDefinitions: [x]So a provisioned value over the maximum answers
LimitExceededExceptionon every path measured. On CreateTable the definition checks come first, then the table's existence, then the capacity limit.Requestedin the GSI sentence is the table and its indexes after the change.Two answers are not in these measurements:
Two more keys are in the same state as the four above:
per_account_max_rcuandper_account_max_wcu(defaults 80,000) are read only byDescribeLimits(crates/engine/src/describe_limits.rs).docs/dynamodb-limits.mdlists the per-table and per-account RCU and WCU limits as enforced.