Overly broad cloud IAM permissions
CriticalAV-PERM-003PermissionsCore pack
What it finds
`"Effect":"Allow"` with `"Action":"*"`, `AdministratorAccess`, `iam:*`, or `"Resource":"*"`.
Why it matters
An agent with administrator-level cloud credentials can modify or delete any resource in the account.
How to fix it
Scope IAM policies to the exact actions and resources the agent needs.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- BROAD_CLOUD_CREDENTIALS
- How it detects
- Looks for a specific risky pattern in the code or config.
- Confidence
- Definite: the risky setting is written plainly in the file.
- Scans
- Cloud IAM policy documents (AWS/GCP/Azure) referenced or embedded in source
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- AI workflow checks out untrusted PR code with secretsAV-PERM-007 · Critical
- Agent's Kubernetes account has cluster-adminAV-PERM-008 · Critical
- No permission or tool scope declaredAV-PERM-001 · High
- Unscoped delegation detectedAV-PERM-002 · High
- LangChain SQL agent with unrestricted database accessAV-FW-002 · High
- Retrieval with no per-customer filterAV-DATA-007 · High