Free resource / No account required

Wildcard IAM review

A checklist for IAM, resource policies, and roles that grant more than the job needs.

You are reading a policy change and want to see which statement is wider than the task.

What you should get

The statements that use a wildcard action, resource, or principal, with a narrower replacement when the file shows the real API calls.

Checklist

• An action is * or a whole service, such as s3:* or iam:*.
• The resource is * when the file already names the bucket, queue, or table.
• A principal is * on a policy that is not meant to be public.
• iam:PassRole or a role assumption is paired with a wildcard action.
• A condition is commented out, so the statement is wider than the note beside it.
• The same permission shows up in a managed policy and again inline.

Review the IAM or resource policy I paste for wildcard access.

Use only the policy text I give you. If the calling code or the list of real API actions is missing, ask for it before you propose a narrower action list.

For each finding:
- Quote the statement.
- Say whether the wildcard is the action, the resource, or the principal.
- Say what that statement can reach beyond the task described in the file.
- Propose a narrower statement only when the file shows the specific actions or ARNs. Otherwise say what you still need.

Do not invent account IDs or resource names.

All free resources · Prompt library. Reading this page does not submit your infrastructure.