Description

Detects IAM policies that grant unrestricted access to AWS Systems Manager (SSM) through wildcard permissions (ssm:*). Full SSM access is high-risk as it allows complete control over instance management, command execution, and parameter store access which could be exploited for unauthorized system access.

Detection Strategy

• Analyzes each IAM policy document and its statements

• Identifies policies where Effect is "Allow" and Action includes "ssm:*"

• Reports a vulnerability when a policy grants unrestricted SSM access through wildcard permissions

• Captures the specific policy ARN and statement location where overly permissive SSM access is granted