A wildcard IAM policy, although convenient, increases likelihood of malicious actions on resources and principals. IAM policy should follow the principle of Least Privileges to fine grain exact actions to exact resources.

Remediation

resource "aws_iam_policy" "s3-limit"{
    name="${var.prefix}-s3-limit-policy"
policy =  <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
            "Sid": "",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:PutObjectAcl"
            ],
            "Resource": [
                "${aws_s3_bucket.example.arn}"
            ]
    }
  ]
}
EOF
}

Metadata

• Severity: medium
• Slug: iam-wildcard-policy

CWEs

• 250: Execution with Unnecessary Privileges

OWASP

• A05:2021: Security Misconfiguration