Description

Detects the use of negative statements (NotAction/NotResource) in AWS IAM policies, which can create overly permissive access by excluding specific actions/resources rather than explicitly allowing only required ones. This pattern is risky as it may unintentionally grant broader permissions than intended.

Detection Strategy

• Scans AWS IAM policy documents in CloudFormation templates

• Identifies policy statements that use NotAction or NotResource elements

• Reports a vulnerability when negative statement patterns are found in policy statements

Vulnerable code example

Resources:
  DangerousPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Statement:
          - Effect: Allow
            NotAction: '*'           # Dangerous: NotAction with wildcard grants all actions except specified...

✅ Secure code example

Resources:
  SecurePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: "Secure policy following least-privilege principle"
      PolicyDocument:
        Version: "2012-10-17"  # Always specify policy version
        Statement:...