Security

1# Intentionally non-compliant fixture — DO NOT deploy, DO NOT sanitize.
2# Regression for the list-form wildcard gap: Resource = ["*"] (single-element
3# list) must FAIL, same as the bare-string Resource = "*" form.
4resource "aws_iam_policy" "bad_listform" {
5  name = "bad-listform-wildcard"
6  policy = jsonencode({
7    Version = "2012-10-17"
8    Statement = [
9      {
10        Effect   = "Allow"
11        Action   = ["s3:*"]
12        Resource = ["*"]
13      }
14    ]
15  })
16}