Maximum policy size of 10240 bytes exceeded for role (many lambdas with onFailure sqs destination)

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest v3 release?

• Yes, I'm using the latest v3 release

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

When I add several functions to my project with an sqs failure destination set, deployment fails with error Error: UPDATE_FAILED: IamRoleLambdaExecution (AWS::IAM::Role) Maximum policy size of 10240 bytes exceeded for role xxx

  eventHandler:
    timeout: 300
    handler: dist/app.eventHandler
    destinations:
      onFailure:
        type: sqs
        arn:
          Fn::GetAtt: ['EventHandlerDLQ', 'Arn']

The generated serverless IAM policy has an entry for sqs:SendMessage for every queue configured as an onFailure destination even though my IAM policy is already allowing these queues with a wildcard permission.

        {
            "Action": "sqs:SendMessage",
            "Resource": "arn:aws:sqs:xxx:xxx:test",
            "Effect": "Allow"
        },
        etc.

As a result deployment is failing because the IAM policy is very large.

Service configuration (serverless.yml) content

iam:
    role:
      statements:
        - Effect: Allow
          Action:
            - sqs:TagQueue
            - sqs:GetQueueUrl
            - sqs:UntagQueue
            - sqs:PurgeQueue
            - sqs:ReceiveMessage
            - sqs:DeleteQueue
            - sqs:DeleteMessage
            - sqs:SendMessage
            - sqs:GetQueueAttributes
            - sqs:ListQueueTags
            - sqs:CreateQueue
          Resource: ${self:custom.config.sqsQueues.arnPrefix}*

functions:
  eventHandler:
    timeout: 300
    handler: dist/app.eventHandler
    destinations:
      onFailure:
        type: sqs
        arn:
          Fn::GetAtt: ['EventHandlerDLQ', 'Arn']

Resources:
  EventHandlerDLQ:
    Type: AWS::SQS::Queue
    Properties:
      QueueName: test
      MessageRetentionPeriod: 1209600

Command name and used flags

N/A

Command output

Error: UPDATE_FAILED: IamRoleLambdaExecution (AWS::IAM::Role) Maximum policy size of 10240 bytes exceeded for role xxx

Environment information

latest

Start by tracing how SQS onFailure destinations generate IAM policy statements during deployment, then compare those statements with the wildcard sqs permissions shown in the service configuration. Done means deployments with many Lambda failure destinations no longer exceed the 10240-byte role policy limit, with regression coverage for the repeated-permission case.