Security

1# Compliant fixture — MUST pass (POLICY_OK).
2# Proves the list-form wildcard check does NOT false-positive on:
3#   (a) a list of scoped actions, and
4#   (b) a list of scoped resource ARNs (list form, but not a "*" wildcard).
5resource "aws_iam_policy" "good_list" {
6  name = "good-scoped-list"
7  policy = jsonencode({
8    Version = "2012-10-17"
9    Statement = [
10      {
11        Effect = "Allow"
12        Action = ["s3:GetObject", "s3:PutObject"]
13        Resource = [
14          "arn:aws:s3:::my-bucket",
15          "arn:aws:s3:::my-bucket/*",
16        ]
17      }
18    ]
19  })
20}