# IAM policy allows every action

A standalone IAM policy statement whose Effect is Allow, or omitted, and whose Action is * or a list containing only *.

Area: Security

## What you need to supply

The policy JSON. The policy is not executed. An IpAddress of 0.0.0.0/0 is checked, and other condition operators are not.

## If it reports a finding

High severity. The suggested next step is to list the required actions instead of allowing every action.

## What this does not prove

An Effect of Deny is not this finding. A statement that lists s3:GetObject is not this finding.

## Statement that this check is written to notice

```
{
  "Version": "2012-10-17",
  "Statement": [{ "Effect": "Allow", "Action": "*", "Resource": "*" }]
}
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/iam-policy-allows-every-action.