Control: IAM policies should not allow full '*' administrative privileges
Description
This control checks whether the default version of IAM policies (also known as customer managed policies) has administrator access that includes a statement with 'Effect': 'Allow' with 'Action': '*' over 'Resource': '*'. The control only checks the customer managed policies that you create. It does not check inline and AWS managed policies.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.iam_policy_custom_attached_no_star_starSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.iam_policy_custom_attached_no_star_star --shareSQL
This control uses a named query:
iam_policy_custom_attached_no_star_star