← all rules
iac/terraform/tf-iam-wildcard-resource
IAM policy grants wildcard resource
mediumTerraformiac-terraform
What it detects
`Resource = "*"` applies a statement to every resource in the account. Paired with broad actions it removes any blast-radius boundary on the granted permissions.
Remediation
Scope the statement to specific ARNs (e.g. a single bucket or table) instead of `*`.
How it runs
Detection layer not documented.
Found a false positive or want this rule tuned? File an issue. You can also suppress per-repo via a .repoguardignore line.