IAM policies must not grant full administrative privileges (Allow for all actions on all resources). Such statements enable privilege escalation and allow any principal with the policy to access, modify, or delete resources account-wide. For Ansible managed policy resources (modules amazon.aws.iam_managed_policy and iam_managed_policy), inspect the policy document’s Statement entries. Ensure no Statement has Effect: Allow where Action is "*" and Resource is "*". Define explicit action lists and restrict Resource to specific ARNs, or use condition keys to enforce least privilege. If full admin rights are truly required, attach AWS-managed administrative policies only to trusted admin roles or groups. Statements matching Effect set to Allow with both Action set to '*' and Resource set to '*' are flagged.
Secure example with explicit actions and narrowed resources:
