Agent audit rule · v0.1.0
Wildcard AWS IAM grant
The policy allows every action (`*`, or NotAction "everything except"), writes or deletes on every resource, or passing or assuming roles on any role. Anyone who can steer the agent gets that reach in the AWS account. Critical for every action on every resource.
- high base severity
- 5 test fixtures
high iam-wildcard
Flagged
// tools.json
4 {
5 "Effect": "Allow",
6 > "Action": "*",
7 "Resource": "*"
8 }Fix
List the exact actions the agent needs and scope Resource to specific ARNs. Limit `iam:PassRole` and `sts:AssumeRole` to named roles, and add Conditions where possible.
Fine
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "*"
}
]
}