Wildcard IAM policy
Action "*" on Resource "*" — the permission grant that ends incident reviews.
Press Run. The stack loaded here fails in a way worth seeing.
▸What the engine finds3 findings
Not examples — Wildcard IAM policy was run through the real engine when this page was built, and this is what it returned.
A statement grants every action. List only the actions the code calls.INTENT
A statement targets every resource in the account.INTENT
▸ 1 informational finding — policy contains a
Policy contains a wildcardAwsSolutions-IAM5DefaultPolicy
A wildcard grants permissions nobody has enumerated, including ones added to AWS after you deployed. Compromise anything holding this role and it reaches everything the wildcard covers.
Full rule text
The IAM entity contains wildcard permissions and does not have a cdk-nag rule suppression with evidence for those permission. Metadata explaining the evidence (e.g. via supporting links) for wildcard permissions allows for transparency to operators. This is a granular rule that returns individual findings that can be suppressed with 'appliesTo'. The findings are in the format 'Action::<action>' for policy actions and 'Resource::<resource>' for resources. Example: appliesTo: ['Action::s3:*']. AwsSolutions-IAM5 guide →
Or start from a stack that fails interestingly
The single most common AI-generated CDK mistake: a bucket left open to the world.
SSH open to the entire internet — the classic copy-paste ingress rule.
Website hosting straight off a bucket — no CDN, no TLS, no access logging.
A database with storage encryption off and backups barely configured.
Action "*" on Resource "*" — the permission grant that ends incident reviews.
A REST API wired to Lambda, wide open, with no access logging.
Fast to write, impossible to restore — no PITR, no encryption choice.
A CDN that will happily serve your site unencrypted, with no logging.
A queue with no server-side encryption and no dead-letter queue.
Network traffic no one can reconstruct after the fact.
Six characters, no symbols, no MFA — defaults nobody revisited.
The one that passes. Encrypted, recoverable, with a dead-letter queue — what good looks like.