Security / Public reference

Policy allows any principal

Principal * on an Allow statement inside a resource policy.

What you need to supply

The policy or PolicyDocument inside the resource. A standalone IAM file is checked separately. The policy is not executed.

If it reports a finding

High severity. The suggested next step is to name the trusted principals explicitly.

What this does not prove

An Effect of Deny is not this finding. A principal that is a specific ARN is not this finding. A comment that mentions Principal * is not this finding.

Statement that this check is written to notice

{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "sts:AssumeRole"
}

All review checks. Reading this page does not submit your infrastructure.