IAM policy contains a wildcard

What it means

A policy statement grants `Action: "*"` or `Resource: "*"`. cdk-nag reports these individually, tagged with the specific wildcard it found.

Why it matters

A wildcard grants permissions nobody has enumerated — including actions AWS adds to the service after you deploy. It is also the permission that turns a small compromise into a large one: anything that can assume this role reaches everything the wildcard covers, which is usually far more than the code ever calls.

How to fix it

List the actions the code actually calls and scope resources to specific ARNs. CDK grant helpers (`table.grantReadData(fn)`, `bucket.grantRead(fn)`) generate least-privilege statements for you.

See it fail

This stack trips AwsSolutions-IAM5 for real. Open it in the playground, press Run, and the finding appears with everything else the engine has to say about it.

Other rules