# Policy allows any principal

Principal * on an Allow statement inside a resource policy.

Area: Security

## What you need to supply

The policy or PolicyDocument inside the resource. A standalone IAM file is checked separately. The policy is not executed.

## If it reports a finding

High severity. The suggested next step is to name the trusted principals explicitly.

## What this does not prove

An Effect of Deny is not this finding. A principal that is a specific ARN is not this finding. A comment that mentions Principal * is not this finding.

## Statement that this check is written to notice

```
{
  "Effect": "Allow",
  "Principal": "*",
  "Action": "sts:AssumeRole"
}
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/policy-allows-any-principal.