AWS Service Limits - Amazon Web Services

Amazon API Gateway Limits

The following are API request limits in Amazon API Gateway.

Request	Default Limit
Steady-state deployed API requests	Steady-state: 500 request per second (rps) per account; bursting mode: up to 1000 rps per account
CreateRestApi request	2 requests per minute (rpm) per account.
ImportRestApi request	2 requests per minute per account
PutRestApi request	60 requests per minutes per account
DeleteRestAPI request	2 requests per minutes per account
CreateDeployment request	3 requests per minutes per account
UpdateAccont request	3 requests per minutes per account
GetResources request	150 requests per minutes per account
CreateResource request	300 requests per minutes per account
DeleteResource request	300 requests per minutes per account
CreateDomainName request	2 requests per minutes per account

The following are limits on the API settings in Amazon API Gateway.

Resource	Default Limit
API caching TTL	300 seconds by default and 3600 at maximum
APIs per account	60
API keys per account	10,000
Client certificates per account	60
Resources per API	300
Stages per API	10
Integration timeout	30 second for both AWS Lambda and HTTP integrations; this limit cannot be increased currently
Payload size	10 MB; this limit cannot be increased currently
Number of iterations in a `#foreach ... #end` loop in mapping templates	1000 at maximum
ARN length of a method with authorization	1600 bytes at maximum

For information about additional documented limits, see Limits in Amazon API Gateway in the API Gateway Developer Guide.

AWS Application Discovery Service Limits

Resource	Default Limit
Inactive agents heartbeating but not collecting data	10,000
Active agents sending data to the service	250
Total collected data for all agents, per day	10 GB
Data storage duration before being purged	90 days

Amazon AppStream Limits

An Amazon AppStream account has a service limit of up to five concurrent streaming sessions:

Up to two concurrent streaming application deployments using the interactive wizard.
Up to three streaming applications in the Building, Active, or Error states.

For more information, see Amazon AppStream Application Lifecycle in the Amazon AppStream Developer Guide.

Application Auto Scaling Limits

Resource	Default Limit
Step adjustments per scaling policy	20

Auto Scaling Limits

Resource	Default Limit
Launch configurations	100
Auto Scaling groups	20
Lifecycle hooks per Auto Scaling group	50
Load balancers per Auto Scaling group	50
Step adjustments per scaling policy	20

For information about additional documented limits, see Auto Scaling Limits in the Auto Scaling User Guide.

AWS Certificate Manager Limits

Resource	Default Limit
Number of ACM Certificates	20
Number of domain names per ACM Certificate	10

AWS CloudFormation Limits

Resource	Default Limit
Stacks	200

For information about additional documented limits, see AWS CloudFormation Limits in the AWS CloudFormation User Guide.

Amazon CloudFront Limits

Resource	Default Limit
Data transfer rate per distribution	10 Gbps
Requests per second per distribution	15,000
Web distributions per account	200
RTMP distributions per account	100
Alternate domain names (CNAMEs) per distribution	100
Origins per distribution	25
Cache behaviors per distribution	25
Whitelisted headers per cache behavior	10
Whitelisted cookies per cache behavior	10
SSL certificates per account when serving HTTPS requests using dedicated IP addresses (no limit when serving HTTPS requests using SNI)	2
Custom headers that you can have Amazon CloudFront forward to the origin	10 name–value pairs

For information about additional documented limits, see Limits in the Amazon CloudFront Developer Guide.

AWS CloudHSM Limits

Resource	Default Limit
HSM appliances	3
High-availability partition groups	20
Clients	800

Amazon CloudSearch Limits

Resource	Default Limit
Partitions	10
Search instances	50

For information about additional documented limits, see Understanding Amazon CloudSearch Limits in the Amazon CloudSearch Developer Guide.

AWS CodeCommit Limits

Resource	Default Limit
Number of repositories	1,000 per AWS account

For information about additional documented limits, see Limits in AWS CodeCommit in the AWS CodeCommit User Guide.

AWS CodeDeploy Limits

Resource	Default Limit
Number of applications under an account in a single region	40
Number of concurrent deployments under an account	10
Number of deployment groups associated with a single application	50
Number of instances in a single deployment	50

For information about additional documented limits, see Limits in AWS CodeDeploy in the AWS CodeDeploy User Guide.

AWS CodePipeline Limits

Resource	Default Limit
Number of pipelines per AWS account	20
Number of stages in a pipeline	Minimum of 2, maximum of 10
Number of actions in a stage	Minimum of 1, maximum of 20
Number of custom actions per AWS account	20
Maximum number of revisions running across all pipelines	20
Maximum size of source artifacts	500 megabytes (MB)
Maximum number of times an action can be run per month	1,000 per calendar month

It may take up to two weeks to process requests for a limit increase.

For information about additional documented limits, see Limits in AWS CodePipeline in the AWS CodePipeline User Guide.

AWS Database Migration Service Limits

Resource	Default Limit
Replication instances	20
Total amount of storage	6 TB
Event subscriptions	100
Replication subnet groups	20
Subnets per replication subnet group	20
Endpoints	100
Tasks	100
Endpoints per instance	100

AWS Device Farm Limits

Resource	Default Limit	Comments
App file size you can upload	4 GB
Number of devices AWS Device Farm can test during a run	5	This limit can be increased to 100 upon request.
Number of devices you can include in a test run	None
Number of runs you can schedule	None
Duration of a remote access session	60 minutes

AWS Directory Service Limits

Resource	Default Limit
Simple AD directories	10
AD Connector directories	10
Manual snapshots	5 per Simple AD

Amazon DynamoDB Limits

Resource	Default Limit
US East (N. Virginia) Region: Maximum capacity units per table or global secondary index	40,000 read capacity units and 40,000 write capacity units
US East (N. Virginia) Region: Maximum capacity units per account	80,000 read capacity units and 80,000 write capacity units
All other Regions: Maximum capacity units per table or global secondary index	10,000 read capacity units and 10,000 write capacity units
All other Regions: Maximum capacity units per account	20,000 read capacity units and 20,000 write capacity units
Maximum number of tables	256

For information about additional documented limits, see Limits in Amazon DynamoDB in the Amazon DynamoDB Developer Guide.

Amazon EC2 Container Registry (Amazon ECR) Limits

Resource	Default Limit
Maximum number of repositories per account	1,000
Maximum number of images per repository	1,000

For information about additional documented limits, see Amazon ECR Service Limits in the Amazon EC2 Container Registry User Guide.

Amazon EC2 Container Service (Amazon ECS) Limits

Resource	Default Limit
Number of clusters per region, per account	1000
Number of container instances per cluster	1000
Number of services per cluster	500

For information about additional documented limits, see Amazon ECS Service Limits in the Amazon EC2 Container Service Developer Guide.

AWS Elastic Beanstalk Limits

Resource	Default Limit
Applications	75
Application Versions	1000
Environments	200

Amazon Elastic Block Store (Amazon EBS) Limits

Resource	Default Limit
Number of EBS volumes	5,000
Number of EBS snapshots	10,000
Total volume storage of General Purpose SSD (`gp2`) volumes	20 TiB
Total volume storage of Provisioned IOPS SSD (`io1`) volumes	20 TiB
Total volume storage of Throughput Optimized HDD (`st1`)	20 TiB
Total volume storage of Cold HDD (`sc1`)	20 TiB
Total volume storage of Magnetic volumes	20 TiB
Total provisioned IOPS	40,000

For information about additional documented limits, see Amazon EC2 Service Limits in the Amazon EC2 User Guide for Linux Instances.

Amazon Elastic Compute Cloud (Amazon EC2) Limits

Resource	Default Limit
Elastic IP addresses for EC2-Classic	5
Security groups for EC2-Classic per instance	500
Rules per security group for EC2-Classic	100
Key pairs	5,000
Throttle on the emails that can be sent from your Amazon EC2 account	Throttle applied
On-demand instances	Limits vary depending on instance type. For more information, see How many instances can I run in Amazon EC2.
Spot Instances	Limits vary depending on instance type, region, and account. For more information, see Spot Instance Limits.
Reserved Instances	20 instance reservations per Availability Zone, per month
AMI Copies	Destination regions are limited to 50 concurrent AMI copies at a time, with no more than 25 of those coming from a single source region.

For information about related limits for EC2-VPC, see Amazon Virtual Private Cloud (Amazon VPC) Limits.

For information about viewing your current limits, see Amazon EC2 Service Limits in the Amazon EC2 User Guide for Linux Instances.

Amazon EC2 Simple Systems Manager Limits

Resource	Default Limit	Comment
SSM documents	200	Each AWS account can create a maximum of 200 documents.
Privately shared SSM document	20	A single SSM document can be shared with a maximum of 20 AWS accounts.
Publicly shared SSM document	5	Each AWS account can publicly share a maximum of five documents.
Associations	10,000	Each SSM document can be associated with a maximum of 10,000 instances.

Amazon ElastiCache Limits

Resource	Default Limit	Description
Nodes per region	50	The maximum number of nodes across all clusters in a region.
Nodes per cluster (Memcached)	20	The maximum number of nodes in an individual Memcached cluster.
Nodes per cluster (Redis)	1	The maximum number of nodes in an individual Redis cluster.
Clusters per replication group (Redis)	6	The maximum number of clusters in a Redis replication group. One is the read/write primary. All others are read only replicas.
Parameter Groups per region	20	The maximum number of parameters groups you can create in a region.
Security Groups per region	50	The maximum number of security groups you can create in a region.
Subnet Groups per region	50	The maximum number of subnet groups you can create in a region.
Subnets per Subnet Group	20	The maximum number of subnets you can define for a subnet group.

These limits are global limits per customer account. If you need to exceed these limits, make your request using the Amazon ElastiCache Cache Node request form.

Elastic Load Balancing Limits

Resource	Default Limit	Comments
Load balancers per region	20	This limit can be increased upon request
Listeners per load balancer	100	This limit cannot be increased
Security groups per load balancer	5	This limit cannot be increased
Subnets per Availability Zone per load balancer	1	This limit cannot be increased

For information about additional documented limits, see Elastic Load Balancing Limits in the Elastic Load Balancing Developer Guide.

Amazon Elastic Transcoder Limits

Resource	Default Limit
Pipelines per region	4
User-defined presets	50
Maximum number of jobs processed simultaneously by each pipeline	US East (N. Virginia) region – 20 US West (N. California) region – 12 US West (Oregon) region – 20 EU (Ireland) region – 20 Asia Pacific (Singapore) region – 12 Asia Pacific (Tokyo) region – 12

Resource

Default Limit

Pipelines per region

4

User-defined presets

50

Maximum number of jobs processed simultaneously by each pipeline

US East (N. Virginia) region – 20

US West (N. California) region – 12

US West (Oregon) region – 20

EU (Ireland) region – 20

Asia Pacific (Singapore) region – 12

Asia Pacific (Tokyo) region – 12

It may take up to two weeks to process requests for a limit increase.

For information about additional documented limits, see Amazon Elastic Transcoder limits in the Amazon Elastic Transcoder Developer Guide.

Amazon Elasticsearch Service Limits

Resource	Default Limit
Number of Elasticsearch instances per cluster	20

Amazon GameLift Limits

Resource	Default Limit
Aliases	20
Fleets	20
Builds	1000
Total size of builds	100 GB
Log upload size per game session	200 MB
On-demand instances	Limits vary depending on instance type; 20 instances per account, regardless of instance type
Player sessions per game session	200

For information about additional documented limits, see Scaling Amazon Elastic Compute Cloud (Amazon EC2) Instances in the Amazon GameLift Developer Guide.

AWS Identity and Access Management (IAM) Limits

Resource	Default Limit
Groups per account	100
Instance profiles	100
Roles	250
Server certificates	20
Users	5000

For information about additional documented limits, see Limitations on IAM Entities and Objects in the IAM User Guide.

Amazon Inspector Limits

Resource	Default Limit
Running agents	500
Assessment runs	50,000
Assessment templates	500
Assessment targets	50

For more information, see the Amazon Inspector User Guide.

AWS IoT Limits

The following limits apply to the message broker:

Topic length limit	The topic passed to the message broker when publishing a message cannot exceed 256 bytes encoded in UTF-8.
Restricted topic prefix	Topics beginning with '$' are considered reserved and are not supported for publishing and subscribing except when working with the Thing Shadows service.
Maximum number of slashes in topic and topic filter	A topic provided while publishing a message or a topic filter provided while subscribing can have no more than eight forward slashes (/).
Client ID size limit	128 bytes encoded in UTF-8.
Restricted client ID prefix	'$' is reserved for internally generated client IDs.
Message size limit	The payload for every publish message is limited to 128 KB. The AWS IoT service will reject messages larger than this size.
Throughput per connection	AWS IoT limits the ingress and egress rate on each client connection to 512 KB/s. Data sent or received at a higher rate will be throttled to this throughput.
Maximum subscriptions per subscribe call	A single subscribe call is limited to request a maximum of eight subscriptions.
Subscriptions per session	The message broker limits each client session to subscribe to up to 50 subscriptions. A subscribe request that pushes the total number of subscriptions past 50 will result in the connection being disconnected.
Connection inactivity (keep-alive) limits	By default, an MQTT client connection is disconnected after 30 minutes of inactivity. When the client sends a PUBLISH, SUBSCRIBE, PING, or PUBACK message, the inactivity timer is reset. A client can request a shorter keep-alive interval by specifying a keep-alive value between 5-1,200 seconds in the MQTT CONNECT message sent to the server. If a keep-alive value is specified, the server will disconnect the client if it does not receive a PUBLISH, SUBSCRIBE, PINGREQ, or PUBACK message within a period 1.5 times the requested interval. The keep-alive timer starts after the sender sends a CONNACK. If a client sends a keep-alive value of zero, the default keep-alive behavior will remain in place. If a client request a keep-alive shorter than 5 seconds, the server will treat the client as though it requested a keep-alive interval of 5 seconds. The keep-alive timer begins immediately after the server returns a CONNACK to the client. There may be a brief delay between the client's sending of a CONNECT message and the start of keep-alive behavior.
Maximum inbound unacknowledged messages	The message broker allows 100 in-flight unacknowledged messages (limit is across all messages requiring ACK). When this limit is reached, no new messages will be accepted until an ACK is returned by the server.
Maximum outbound unacknowledged messages	The message broker only allows 100 in-flight unacknowledged messages (limit is across all messages requiring ACK). When this limit is reached, no new messages will be sent to the client until the client acknowledges the in-flight messages.
Maximum retry interval for delivering QoS 1 messages	If a connected client is unable to receive an ACK on a QoS 1 message for one hour, the message broker will drop the message. The client may be unable to receive the message if it has 100 in-flight messages, it is being throttled due to large payloads, or other errors.
WebSocket connection duration	WebSocket connections are limited to 24 hours. If the limit is exceeded, the WebSocket connection will automatically be closed when an attempt is made to send a message by the client or server. If you need to maintain an active WebSocket connection for longer than 5 minutes, simply close and re-open the WebSocket connection from the client side before the 5 minutes elapses.

The following limits apply to thing shadows:

Maximum size of a JSON state document	The maximum size of a JSON state document is 8 KB.
Maximum number of JSON objects per AWS account	There is no limit on the number of JSON objects per AWS account.
Shadow lifetime	A thing shadow is deleted by AWS IoT if it has not been updated or retrieved in more than 1 year.
Maximum number of in-flight, unacknowledged messages	The Thing Shadows service supports up to 10 in-flight unacknowledged messages. When this limit is reached, all new shadow requests will be rejected with a 429 error code.
Maximum depth of JSON device state documents	The maximum number of levels in the "desired" or "reported" section of the JSON device state document is 5. For example: `"desired": { "one": { "two": { "three": { "four": { "five":{ } } } } } }`

The following limits apply to security and identity:

You can attach up to 10 policies to an AWS IoT certificate.
You can keep up to 5 versions of a named policy.
Policy document size is limited to 2048 characters (excluding white space).

Throttling Limits

The following table lists the throttling limits for AWS IoT API:

API	Transaction per Second
AcceptCertificateTransfer	10
AttachThingPrincipal	15
CancelCertificateTransfer	10
CreateCertificateFromCsr	15
CreatePolicy	10
CreatePolicyVersion	10
CreateThing	15
DeleteCertificate	10
DeleteCACertificate	10
DeletePolicy	10
DeletePolicyVersion	10
DeleteThing	10
DescribeCertificate	10
DescribeCACertificate	10
DescribeThing	10
DetachThingPrincipal	10
DetachPrincipalPolicy	15
DeleteRegistrationCode	10
GetPolicy	10
GetPolicyVersion	15
GetRegistrationCode	10
ListCertificates	10
ListCertificatesByCA	10
ListPolicies	10
ListPolicyVersions	10
ListPrincipalPolicies	15
ListPrincipalThings	10
ListThings	10
ListThingPrincipals	10
RegisterCertificate	10
RegisterCACertificate	10
RejectCertificateTransfer	10
SetDefaultPolicyVersion	10
TransferCertificate	10
UpdateCertificate	10
UpdateCACertificate	10
UpdateThing	10

AWS IoT Rules Engine Limits

The following limit applies to the AWS IoT rules engine

There is a limit of 1000 rules per AWS account.

AWS Snowball (Snowball) Limits

Resource	Default Limit	Comments
Snowball	1	If you need to increase this limit, contact AWS Support.

AWS Key Management Service (AWS KMS) Limits

Resource	Default Limit
Customer Master Keys (CMKs)	1000
Aliases	1100
Grants per CMK	250
Grants for a given principal per CMK	30
Requests per second	Varies by API operation; see Limits in the AWS Key Management Service Developer Guide.

All limits in the preceding table apply per region and per AWS account.

For information about additional documented limits, see Limits in the AWS Key Management Service Developer Guide.

Amazon Kinesis Firehose Limits

Resource	Default Limit
Delivery streams per region	20
Delivery stream capacity †	2,000 transactions/second 5,000 records/second 5 MB/second

Resource

Default Limit

Delivery streams per region

20

Delivery stream capacity †

2,000 transactions/second

5,000 records/second

5 MB/second

† The three capacity limits scale proportionally. For example, if you increase the throughput limit to 10MB/second, the other limits increase to 4,000 transactions/second and 10,000 records/second.

For information about additional documented limits, see Amazon Kinesis Firehose Limits in the Amazon Kinesis Firehose Developer Guide.

Amazon Kinesis Streams Limits

Resource	Default Limit
Shards per region	US East (N. Virginia) region – 50 US West (Oregon) region – 50 EU (Ireland) region – 50 All other supported regions – 25

Resource

Default Limit

Shards per region

US East (N. Virginia) region – 50

US West (Oregon) region – 50

EU (Ireland) region – 50

All other supported regions – 25

For information about additional documented limits, see Amazon Kinesis Streams Limits in the Amazon Kinesis Streams Developer Guide.

AWS Lambda Limits

Resource	Limit
Concurrent requests safety throttle per account	100

For information about additional documented limits, see AWS Lambda Limits in the AWS Lambda Developer Guide.

Amazon Machine Learning (Amazon ML) Limits

Resource	Default Limit
Data file size*	100 GB
Batch prediction input size	1 TB
Batch prediction input (number of records)	100 million
Number of variables in a data file (schema)	1,000
Recipe complexity (number of processed output variables)	10,000
Transactions Per Second for each real-time prediction endpoint	200
Total Transactions Per Second for all real-time prediction endpoints	10,000
Total RAM for all real-time prediction endpoints	10 GB
Number of simultaneous jobs	5
Longest run time for any job	7 days
Number of classes for multiclass ML models	100
ML model size	2 GB

Note

The size of your data files is limited to ensure that jobs finish in a timely manner. Jobs that have been running for more than seven days will be automatically terminated, resulting in a FAILED status.

For information about additional documented limits, see Amazon ML Limits in the Amazon Machine Learning Developer Guide.

AWS OpsWorks Limits

Resource	Default Limit
Stacks	40
Layers per stack	40
Instances per stack	40
Apps per stack	40

Amazon Redshift Limits

Resource	Default Limit
Nodes per cluster	101
Nodes	200
Reserved Nodes	200
Snapshots	20
Parameter Groups	20
Security Groups	20
Subnet Groups	20
Subnets per Subnet Group	20
Event Subscriptions	20

For information about additional documented limits, see Limits in Amazon Redshift in the Amazon Redshift Cluster Management Guide.

Amazon Relational Database Service (Amazon RDS) Limits

Resource	Default Limit
Instances	40
Reserved Instances	40
Total storage for all DB instances	100 TB
Manual Snapshots	50
Parameter Groups	50
Security Groups	25
VPC Security Groups	5
Subnet Groups	20
Subnets per Subnet Group	20
Option Groups	20
Event Subscriptions	20
Read Replicas per Master	5

Amazon Route 53 Limits

Resource	Default Limit
Hosted zones	500
Domains	50
Resource record sets per hosted zone	10,000
Reusable delegation sets	100
Hosted zones that can use the same reusable delegation set	100
Amazon VPCs that you can associate with a private hosted zone	100
Health checks	50
Traffic policies	50
Policy records	5

For information about additional documented limits, see Amazon Route 53 Limits in the Amazon Route 53 Developer Guide.

AWS Service Catalog Limits

Resource	Default Limit
Portfolios	25
Users, groups, and roles	25 per portfolio
Products	25 per portfolio, 25 total
Product versions	10 per product
Constraints	25 per product per portfolio
Tags	3 per product, 3 per portfolio, 10 per stack
Stacks	200 (AWS CloudFormation limit)

Amazon Simple Email Service (Amazon SES) Limits

The following are the default limits for Amazon SES in the sandbox environment.

Resource	Default Limit
Daily sending quota	200 messages per 24 hour period.
Maximum send rate	1 email per second. Note The rate at which Amazon SES accepts your messages might be less than the maximum send rate.
Recipient address verification	All recipient addresses must be verified.

For information about additional documented limits, see Limits in Amazon SES in the Amazon Simple Email Service Developer Guide.

Amazon Simple Notification Service (Amazon SNS) Limits

Resource	Default Limit
Topics per AWS account	100,000

Amazon Simple Queue Service (Amazon SQS)

For information about additional documented limits, see Limits, Restrictions in the Amazon SQS FAQs and Amazon SQS Limits in the Amazon Simple Queue Service Developer Guide.

Amazon Simple Storage Service (Amazon S3) Limits

Resource	Default Limit
Buckets	100 per account

For information about additional documented limits, see Amazon S3 limits in the Amazon Simple Storage Service Developer Guide.

Amazon Simple Workflow Service (Amazon SWF) Limits

For information about additional documented limits, see Amazon SWF Service Limits in the Amazon Simple Workflow Service Developer Guide.

Amazon SimpleDB Limits

Resource	Default Limit
Domains	250

For information about additional documented limits, see Amazon SimpleDB Limits in the Amazon SimpleDB Developer Guide.

Amazon Virtual Private Cloud (Amazon VPC) Limits

Resource	Default limit	Comments
VPCs per region	5	The limit for Internet gateways per region is directly correlated to this one. Increasing this limit will increase the limit on Internet gateways per region by the same amount. If you need to increase this limit, submit a request.
Subnets per VPC	200	If you need to increase this limit, submit a request.
Internet gateways per region	5	This limit is directly correlated with the limit on VPCs per region. You cannot increase this limit individually; the only way to increase this limit is to increase the limit on VPCs per region. Only one Internet gateway can be attached to a VPC at a time.
Virtual private gateways per region	5	If you need to increase this limit, contact AWS Support; however, only one virtual private gateway can be attached to a VPC at a time.
Customer gateways per region	50	If you need to increase this limit, contact AWS Support.
VPN connections per region	50	If you need to increase this limit, submit a request.
VPN connections per VPC (per virtual private gateway)	10	If you need to increase this limit, submit a request.
Route tables per VPC	200	Including the main route table. You can associate one route table to one or more subnets in a VPC.
Routes per route table (non-propagated routes)	50	This is the limit for the number of non-propagated entries per route table. You can submit a request for an increase of up to a maximum of 100; however, network performance may be impacted.
BGP advertised routes per route table (propagated routes)	100	You can have up to 100 propagated routes per route table; however, the total number of propagated and non-propagated entries per route table cannot exceed 100. For example, if you have 50 non-propagated entries (the default limit for this type of entry), you can only have 50 propagated entries. This limit cannot be increased. If you require more than 100 prefixes, advertise a default route.
Elastic IP addresses per region for each AWS account	5	This is the limit for the number of VPC Elastic IP addresses you can allocate within a region. This is a separate limit from the Amazon EC2 Elastic IP address limit. If you need to increase this limit, submit a request.
Security groups per VPC	500	If you need to increase this limit, you can submit a request.
Inbound or outbound rules per security group	50	You can have 50 inbound and 50 outbound rules per security group (giving a total of 100 combined inbound and outbound rules). If you need to increase or decrease this limit, you can contact AWS Support — a limit change applies to both inbound and outbound rules. However, the multiple of the limit for inbound or outbound rules per security group and the limit for security groups per network interface cannot exceed 250. For example, if you want 100 inbound and 100 outbound rules per security group, we decrease your number of security groups per network interface to 2.
Security groups per network interface	5	If you need to increase or decrease this limit, you can contact AWS Support. The maximum is 16. The multiple of the limit for security groups per network interface and the limit for rules per security group cannot exceed 250. For example, if you want 10 security groups per network interface, we decrease your number of rules per security group to 25.
Network interfaces per instance	-	This limit varies by instance type. For more information, see Private IP Addresses Per ENI Per Instance Type.
Network interfaces per region	350	This limit is the greater of either the default limit (350) or your On-Demand instance limit multiplied by 5. The default limit for On-Demand instances is 20. If your On-Demand instance limit is below 70, the default limit of 350 applies. You can increase the number of network interfaces per region by contacting AWS Support, or by increasing your On-Demand instance limit.
Network ACLs per VPC	200	You can associate one network ACL to one or more subnets in a VPC. This limit is not the same as the number of rules per network ACL.
Rules per network ACL	20	This is the one-way limit for a single network ACL, where the limit for ingress rules is 20, and the limit for egress rules is 20. This limit can be increased upon request up to a maximum if 40; however, network performance may be impacted due to the increased workload to process the additional rules.
Active VPC peering connections per VPC	50	If you need to increase this limit, contact AWS Support . The maximum limit is 125 peering connections per VPC. The number of entries per route table should be increased accordingly; however, network performance may be impacted.
Outstanding VPC peering connection requests	25	This is the limit for the number of outstanding VPC peering connection requests that you've requested from your account. If you need to increase this limit, contact AWS Support.
Expiry time for an unaccepted VPC peering connection request	1 week (168 hours)	If you need to increase this limit, contact AWS Support.
VPC endpoints per region	20	If you need to increase this limit, contact AWS Support; up to a maximum of 255 endpoints per VPC.
Flow logs per single network interface, single subnet, or single VPC in a region	2	You can effectively have 6 flow logs per network interface if you create 2 flow logs for the subnet, and 2 flow logs for the VPC in which your network interface resides. This limit cannot be increased.
NAT gateways per Availability Zone	5	If you need to increase this limit, submit a request. A NAT gateway in the `pending`, `active`, or `deleting` state counts against your limit.

For information about additional documented limits, see Amazon VPC Limits in the Amazon VPC User Guide.

AWS WAF Limits

Resource	Default Limit
Web ACLs per account	10
Rules per account	50
Conditions per account	50

For information about additional documented limits, see AWS WAF Limits in the AWS WAF Developer Guide.

Amazon WorkSpaces Limits

Resource	Default Limit	Comments
WorkSpaces	5	To prevent denial of service attacks, accounts new to the Amazon WorkSpaces service are limited to five WorkSpaces.

For information about additional documented limits, see Amazon WorkSpaces Limits in the Amazon WorkSpaces Administration Guide.