SH402: IAM policy grants wildcard permissions

Severity: high · Category: security · Applies to: cloudformation, terraform

Why it matters

An Allow statement with Action '' grants every API action, and with Resource '' as well it is full administrator access. A leaked credential then controls the account.

How to fix

List the specific actions and resources the workload needs (least privilege).

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH402

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH402