An IAM policy that grants everything
A Terraform IAM policy allows "*" on "*" (full admin) for a job that only reads and writes one bucket. Scope it to least privilege.
Scenario
A Terraform aws_iam_policy_document grants actions = ["*"] on resources = ["*"] (full admin)
for a service that only needs to read and write objects in one S3 bucket. If that role's
credentials leak, the blast radius is the whole account.
Your job
In main.tf, scope the policy statement to least privilege:
- Replace the wildcard actions with the specific S3 actions the app needs
(e.g.
s3:GetObject,s3:PutObject). - Replace the wildcard resources with the bucket's ARN (
arn:aws:s3:::app-bucket/*).
What "done" looks like
No "*" in the statement's actions or resources, and the actions are specific S3 actions.
Graded on the configuration's shape, not a real apply.
Teaches: least privilege in infrastructure-as-code: name the exact actions and resources a role needs instead of granting
*.
What gets checked
Your solution is verified against each of these:
- The policy grants no wildcard action ("*")
- The policy grants no wildcard resource ("*")
- The policy lists specific actions (e.g. s3:GetObject)
Solve it in your browser
No setup, no install. Write your solution in the editor and hit Check. The in-house engine renders and grades it instantly, then issues your proof the moment every check passes.
Solve in browser →Prefer your own lab?
- Build the fix locally. New to the tooling? See setting up your lab.
- Push your topology file, device configs, and any playbooks to a public repo (GitHub or GitLab).
- Submit the repo link. We review it by hand, confirm it works, and issue your proof page.