rules:
- id: wildcard-assume-role
  patterns:
  - pattern-inside: |
      "Statement": [...]
  - pattern-inside: |
      {..., "Effect": "Allow", ..., "Action": "sts:AssumeRole", ...}
  - pattern: |
      "Principal": {..., "AWS": "*", ...}
  message: >-
    Detected wildcard access granted to sts:AssumeRole. This means anyone with your
    AWS account ID and the name of the role can assume the role. Instead, limit to
    a specific identity in your account, like this: `arn:aws:iam::<account_id>:root`.
  metadata:
    cwe:
    - 'CWE-250: Execution with Unnecessary Privileges'
    category: security
    technology:
    - aws
    references:
    - https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
    owasp:
    - A06:2017 - Security Misconfiguration
    - A05:2021 - Security Misconfiguration
    subcategory:
    - vuln
    likelihood: HIGH
    impact: HIGH
    confidence: MEDIUM
  languages: [json]
  severity: ERROR