Security / Public reference

Wildcard IAM permissions

An unrestricted IAM action pattern in the supplied infrastructure text.

What you need to supply

Infrastructure text that includes the permission statement. The check does not read an IAM console or account.

If it reports a finding

High severity. The suggested next step is to replace the wildcard with the smallest permission set the workload needs.

What this does not prove

It cannot tell whether a wildcard is justified by a break-glass process outside the text you supplied.

Action pattern that this check is written to notice

statement {
  actions = ["*"]
}

All review checks. Reading this page does not submit your infrastructure.