iac/iam/iam-aws-service-wildcard-action

AWS IAM policy grants service-wide wildcard (service:*)

mediumCloud IAMiac-iam

What it detects

A `"<service>:*"` action grants every operation in that service (e.g. all of S3, including delete). Usually broader than the workload needs.

Remediation

List the specific operations required instead of the service-wide wildcard.

How it runs

Run against JSON/YAML/source files. AWS IAM rules require a policy-document context (Statement + Effect); GCP primitive roles are matched anywhere. HCL is left to the Terraform layer.

Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.