Will It Vibe?Resource policy allows any principal ("*")
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A resource policy with Principal "*" (or "AWS": "*") lets any AWS account, or anyone at all, use the resource, which commonly exposes S3 buckets, SNS topics, and SQS queues publicly.
Why it matters
A resource policy with Principal "*" or "AWS": "*" allows any principal, potentially anyone on the internet, to use the resource. This is a frequent cause of public S3 buckets, SNS topics, and SQS queues, and it can expose data or let outsiders publish messages into your systems. A wildcard principal should be a deliberate, tightly conditioned choice.
How to fix it
Replace the wildcard principal with the specific account IDs, roles, or service principals that need access. If the resource must be public, keep the wildcard but add strict conditions (such as aws:SourceArn, aws:SourceAccount, or a source IP range) and confirm public access is truly intended. Review these policies against S3 public access block settings.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo