Step Functions execution data size 256KB limit

By Sai Kiran Pandrala · Last verified: 2026-05-31 · Source: community Q&A, AWS re:Post, AWS docs

Running into Step Functions execution data size 256KB limit on AWS Step Functions is one of the more searched issues on AWS re:Post and StackOverflow in the last 12 months. Here is what actually moves the needle when the AWS docs are too generic.

What step functions execution data size 256kb limit actually involves on AWS Step Functions

This task on AWS Step Functions is one of the more searched operational topics on AWS in the last 12 months. The procedure below is the path that works in a current AWS account with default IAM and standard VPC config.

The rest of this page is the structured fix path. Start with diagnose, then remediation, then the automation options so you do not have to do this by hand the next time it surfaces. Verify and safety sections at the end are the discipline that keeps the fix from regressing in production.

Signal review

Look at the CloudTrail event for the failed call, even if you are not enrolled in CloudTrail Lake. The basic 90-day event history works for most diagnostic purposes and lives in the console under CloudTrail > Event history. Filter by event name (the API action) and time range; the event JSON shows the exact user identity, source IP, request parameters, and error code.

Diff against last known good. The last config change you made is the cause about three quarters of the time, even when the change should not have mattered. Use AWS Config history (or your Terraform / CloudFormation drift report) to see the actual delta between the resource state when it worked and when it broke. The change you remember is often not the only change that happened.

Run aws sts get-caller-identity first. About one in five 'why does this not work' tickets are actually 'I am in the wrong account' or 'my session expired and the SDK is using stale creds'. The 5-second sanity check costs nothing and saves real time when the answer is that simple.

Solution-focused remediation path

When the failure happens in production but not in dev, do not just compare the IAM policy. Compare the SCP / RCP at the OU level, the permission boundary on the role, and the resource-based policy on the target. One of those is almost always different between accounts. AWS Config conformance packs make this comparison routine.

For IAM and STS issues, the timing matters. STS sessions can take up to 60 seconds to propagate after creation. The first call right after assume-role can fail with a permission error even when the policy is correct. Add a small retry with backoff before treating the first failure as definitive.

If the issue points at IAM, do not start by adding * to a policy. Use IAM Access Analyzer (Policy Generator) against the failed action to see the minimum scope. Adding * is the fastest way to fail your next AWS Well-Architected security review, and it usually does not even fix the issue because the explicit deny is often coming from a higher level (SCP, RCP, or permission boundary), not a missing allow.

Automate this fix so you do not do it twice

Automate the fix with the AWS CLI

The CLI one-liner pattern for AWS Step Functions operations is roughly: aws step describe-... --query ... to read state, aws step modify-... --no-dry-run to apply the change, and aws step describe-... --query ... again to verify. Wrap it in a shell script that sets a region variable at the top and exits on first error with set -euo pipefail so a partial run does not leave the account in a half-fixed state.

# Template - replace placeholders with your account specifics
export AWS_REGION=us-east-1
export AWS_PROFILE=prod
aws step describe-... --query 'Resources[?Status==`FAILED`].[Id,Reason]' --output table
aws step modify-... --resource-id RESOURCE_ID --no-dry-run
aws step describe-... --resource-id RESOURCE_ID --query 'Status'

Automate the fix with Python and boto3

For anything you do more than twice, write a small Python script. The boto3 pattern below uses paginators (so it does not blow up on accounts with thousands of resources), explicit region binding, and a dry-run flag that defaults to True. Keep the script under 100 lines; if it grows beyond that, you are building a tool and should put it behind a Lambda with proper logging.

import boto3, sys
DRY_RUN = '--apply' not in sys.argv
client = boto3.client('step', region_name='us-east-1')
paginator = client.get_paginator('describe_...')
for page in paginator.paginate(): for item in page.get('Items', []): if item.get('Status') == 'FAILED': if DRY_RUN: print(f'[dry-run] would fix {item["Id"]}') else: client.modify_...(ResourceId=item['Id']) print(f'fixed {item["Id"]}')

Add a Systems Manager Automation runbook

For multi-step fixes that include a manual approval, use SSM Automation. Document the fix as a runbook with aws:approve steps where a human signs off and aws:executeAwsApi steps where the runbook calls the AWS API. Approvers are notified by SNS; the runbook execution shows up in CloudTrail with the approver's identity attached. This makes audit trails easy and stops production fixes from being one-person operations.

Things that bite

The most common pitfall when fixing this on AWS Step Functions is treating it as a one-off rather than as a recurring class of incident. The same misconfiguration tends to happen again after a deployment, a role rotation, or a region migration unless the fix is codified. Add a CloudFormation hook, Service Control Policy condition, or AWS Config rule that prevents the same misconfig from being introduced again. Documentation alone does not survive turnover.

Another common trap: confirming the fix on a single resource and assuming the fleet is healthy. Loop your check across every account, region, and IAM principal that could exhibit the same symptom. If you cannot enumerate the affected scope without a script, you do not yet understand the scope.

Repair sequence

• Reproduce the original symptom path. If it still surfaces in any account or region or IAM role, you have not fixed it.
• Watch for 24 to 48 hours. AWS metrics and policy systems can mask issues with cached health for 6 to 12 hours, especially CloudFront and Route 53.
• Run a smoke test under realistic load. Happy-path tests miss race conditions and IAM session-cache issues.
• Capture the new state in a runbook so the next person on call does not have to rediscover this. Push it to Confluence or your team wiki, not into Slack.
• If the fix involved a permission change, run IAM Access Analyzer one more time to confirm you did not open a separate hole while closing this one.

Safety, rollback, blast radius

• Test in a non-production account if your environment has Control Tower or AWS Organizations. The cost of one sandbox account is cheaper than one rollback meeting.
• Export the existing config before changing it. Most AWS Step Functions resources support describe + export to JSON via CLI - capture that to source control before you start.
• Know your rollback path. Some AWS Step Functions operations are one-way (region migration, account-level feature opt-in, KMS key deletion past pending window). Confirm reversibility on the AWS doc before you commit.
• Be aware of cross-service impact. IAM role changes ripple to every service trusting that role. KMS key changes break every workload depending on that key. VPC endpoint changes affect every VPC consumer of that endpoint.
• Maintenance window discipline: if the change touches DNS, certificate rotation, or anything that emits TLS handshakes, line up a window with stakeholder notification, not a heroic mid-day swap.

FAQ

Related fixes

Related guides worth a look while you sort this one out:

• Step Functions Distributed Map child execution limit
• Step Functions execution stuck IN_PROGRESS hours
• Step Functions Map state inline iteration limit 40
• SQS message size limit 256KB exceeded
• How to integrate AWS Batch with Step Functions for orchestration
• How to fix Lambda concurrent execution limit reached for reserved concurrency