Security

1# Compliant fixture — scoped IAM. MUST pass (POLICY_OK).
2resource "aws_iam_policy" "good" {
3  name = "good-scoped"
4  policy = jsonencode({
5    Version = "2012-10-17"
6    Statement = [
7      {
8        Effect   = "Allow"
9        Action   = ["secretsmanager:GetSecretValue"]
10        Resource = "arn:aws:secretsmanager:us-east-1:111122223333:secret:db-password-*"
11      }
12    ]
13  })
14}
15
16# Assume-role trust policy with sts:AssumeRole is NOT a wildcard violation.
17resource "aws_iam_role" "app" {
18  name = "app-role"
19  assume_role_policy = jsonencode({
20    Version = "2012-10-17"
21    Statement = [
22      {
23        Effect    = "Allow"
24        Action    = "sts:AssumeRole"
25        Principal = { Service = "lambda.amazonaws.com" }
26      }
27    ]
28  })
29}