# Wildcard IAM permissions

An unrestricted IAM action pattern in the supplied infrastructure text.

Area: Security

## What you need to supply

Infrastructure text that includes the permission statement. The check does not read an IAM console or account.

## If it reports a finding

High severity. The suggested next step is to replace the wildcard with the smallest permission set the workload needs.

## What this does not prove

It cannot tell whether a wildcard is justified by a break-glass process outside the text you supplied.

## Action pattern that this check is written to notice

```
statement {
  actions = ["*"]
}
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/wildcard-iam-permissions.