Description

Detects CloudFormation IAM policies that use wildcard (*) resources while granting write permissions. This creates overly permissive access control that violates the principle of least privilege, potentially allowing actions on unintended AWS resources.

Detection Strategy

• Scans CloudFormation templates for IAM managed policies and role trust policies

• Identifies policy statements that grant write/modify permissions (e.g. Put*, Update*, Delete*, Create*)

• Checks if the Resource field in these statements uses wildcards (*)

• Reports a vulnerability when write permissions are combined with wildcard resources in policy statements

Vulnerable code example

Resources:
  AdminRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow...

✅ Secure code example

Resources:
  AdminRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow...