When uploading a file larger than 16 MBs to an Amazon site, the incident only shows a 16 MB attachment.
The same file uploaded to a non-Amazon site will show the correct size in the incident.
The detection size limitation is the default 30 MB.
The policy does not have its own attachment size retention limit.
That particular Amazon site has a 16 MB limit for attachments.
By some unknown method, when an attempt is made to upload a file larger than 16 MB to that particular Amazon site, the file is truncated to 16 MB.
That 16 MB file is what is sent to the Network Protect for Web server for detection.
Thus the incident shows the file size is 16 MBs.