Security / Public reference

IAM policy allows every action

A standalone IAM policy statement whose Effect is Allow, or omitted, and whose Action is * or a list containing only *.

What you need to supply

The policy JSON. The policy is not executed. An IpAddress of 0.0.0.0/0 is checked, and other condition operators are not.

If it reports a finding

High severity. The suggested next step is to list the required actions instead of allowing every action.

What this does not prove

An Effect of Deny is not this finding. A statement that lists s3:GetObject is not this finding.

Statement that this check is written to notice

{
  "Version": "2012-10-17",
  "Statement": [{ "Effect": "Allow", "Action": "*", "Resource": "*" }]
}

All review checks. Reading this page does not submit your infrastructure.