Description

Identifies overly permissive IAM policies in CloudFormation templates that use wildcards (*) in resource definitions or actions. Such policies violate the principle of least privilege and can grant excessive permissions, potentially allowing unintended access to AWS resources.

Detection Strategy

• Scan CloudFormation template files for IAM policy definitions

• Check policy statements for resource ARNs and action definitions

• Flag policies that use wildcards (*) in resource fields

• Flag policies that use wildcards (*) in action fields (e.g., s3:*)

• Report vulnerabilities when policies grant broad permissions instead of specific, limited access

Vulnerable code example

Resources:
  AdminRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow...

✅ Secure code example

Resources:
  EC2ServiceRole:  # Renamed to be more descriptive
    Type: AWS::IAM::Role
    Properties:
      Description: "Role for EC2 instances with minimum required permissions"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:...