iac/terraform/tf-iam-wildcard-action

IAM policy grants wildcard action

highTerraformiac-terraform

What it detects

A policy statement with `Action = "*"` (or `"<service>:*"`) grants every API call. Combined with a broad resource this is effectively admin, and it violates least privilege — a compromise of the principal becomes a compromise of everything it can reach.

Remediation

Enumerate the specific actions the principal needs (e.g. `s3:GetObject`, `s3:PutObject`) instead of `*`.

How it runs

Detection layer not documented.

Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.