September 29, 2026 路 #13
A role that can do anything
A new service role was created with this policy. What is wrong with shipping it?
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}]
}Next puzzle in UTC
One try. The first answer sticks.
How to fix it
Action * and Resource * is administrator access. Replace it with the specific actions and ARNs the service uses, and deny iam:* unless the service is an account factory.
This statement is AdministratorAccess written out by hand. The service can read every bucket, stop every database, and attach this same policy to a new user. CloudWatch logs do not require that. logs:CreateLogStream and logs:PutLogEvents on one log group are enough.
Start from a CloudTrail slice of what the workload called in staging. If you do not have that yet, write the actions you believe it needs and expect the first deploy to miss one. An access denied in staging is cheaper than a role you cannot explain in an incident.
Fix
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject"],
"Resource": "arn:aws:s3:::acme-uploads/*"
}
Add a permission boundary on roles created by CI so a future change cannot widen this back to * without a second review. Access Analyzer will flag the star policy the moment it is attached.