iam policy structural audit derived

{
  "input": {
    "body": {
      "policy": "{\n \"Version\": \"2008-10-17\",\n \"Statement\": [\n  {\n   \"Sid\": \"Admin\",\n   \"Effect\": \"Allow\",\n   \"Action\": \"*\",\n   \"Resource\": \"*\"\n  },\n  {\n   \"Sid\": \"AllButBilling\",\n   \"Effect\": \"Allow\",\n   \"NotAction\": [\n    \"aws-portal:*\"\n   ],\n   \"Resource\": [\n    \"arn:aws:s3:::reports/*\"\n   ]\n  },\n  {\n   \"Sid\": \"IamWide\",\n   \"Effect\": \"Allow\",\n   \"Action\": [\n    \"iam:*\"\n   ],\n   \"Resource\": [\n    \"arn:aws:iam::123456789012:role/app\"\n   ]\n  },\n  {\n   \"Sid\": \"DenyElsewhere\",\n   \"Effect\": \"Deny\",\n   \"Action\": [\n    \"s3:*\"\n   ],\n   \"Resource\": [\n    \"arn:aws:s3:::other-account-bucket/*\"\n   ]\n  }\n ]\n}"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxEnvBytes": 131072,
        "maxFindings": 500,
        "maxPlanBytes": 4194304,
        "maxResources": 5000,
        "maxStatements": 500,
        "maxPolicyBytes": 262144
      },
      "passed": false,
      "bounded": false,
      "version": "2008-10-17",
      "complete": true,
      "findings": [
        {
          "code": "VERSION_NOT_CURRENT",
          "detail": "The policy declares Version \"2008-10-17\". Anything other than 2012-10-17 disables policy variables and some condition operators without saying so."
        },
        {
          "code": "ALLOW_WILDCARD_ACTION_AND_RESOURCE",
          "detail": "Admin allows * on every resource. An action wildcard with a resource wildcard is the whole of what the principal can reach, which is different from either wildcard on its own.",
          "statement": "Admin"
        },
        {
          "code": "WILDCARD_WITHOUT_CONDITION",
          "detail": "Admin uses a wildcard and declares no Condition, so nothing narrows it at evaluation time.",
          "statement": "Admin"
        }
      ],
      "deny_count": 1,
      "request_id": "example-request",
      "service_id": "iam_policy_structural_audit",
      "statements": [
        {
          "sid": "Admin",
          "effect": "Allow",
          "action_count": 1,
          "has_condition": false,
          "principal_count": 0,
          "uses_not_action": false,
          "wildcard_action": true,
          "uses_not_resource": false,
          "wildcard_resource": true
        },
        {
          "sid": "AllButBilling",
          "effect": "Allow",
          "action_count": 0,
          "has_condition": false,
          "principal_count": 0,
          "uses_not_action": true,
          "wildcard_action": false,
          "uses_not_resource": false,
          "wildcard_resource": false
        },
        {
          "sid": "IamWide",
          "effect": "Allow",
          "action_count": 1,
          "has_condition": false,
          "principal_count": 0,
          "uses_not_action": false,
          "wildcard_action": true,
          "uses_not_resource": false,
          "wildcard_resource": false
        }
      ],
      "allow_count": 3,
      "assumptions": [
        "An action wildcard together with a resource wildcard is reported as its own finding, because neither on its own means what the pair means.",
        "NotAction and NotResource in an Allow are reported because they define the permitted set by exclusion, so the policy widens whenever the cloud gains an action or the account gains a resource, without ...",
        "ARN and action patterns are matched with a non-backtracking sweep, so a pattern supplied by a caller cannot make matching expensive."
      ],
      "limitations": [
        "The policy document supplied. What it is attached to, which other policies apply, and what a permission boundary or an organisation policy allows are all outside this. Not a security assessment or a c...",
        "bounded is true only when every statement was read and nothing widened the policy in the ways reported."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 7,
      "service_version": "1.0.0",
      "statement_count": 4,
      "findings_by_code": {
        "VERSION_NOT_CURRENT": 1,
        "ALLOW_USES_NOT_ACTION": 1,
        "ALLOW_WILDCARD_ACTION": 1,
        "WILDCARD_WITHOUT_CONDITION": 2,
        "ALLOW_WILDCARD_ACTION_AND_RESOURCE": 1,
        "ALLOW_WILDCARD_ON_PRIVILEGE_SERVICE": 1
      },
      "wildcard_statement_count": 3,
      "conditions_required_on_wildcards": true
    }
  }
}