{
  "apiVersion": "json.kyverno.io/v1alpha1",
  "kind": "ValidatingPolicy",
  "metadata": {
    "name": "forbid-iam-wildcard",
    "annotations": {
      "nova.cloudinit.dev/severity": "high",
      "title.policy.kyverno.io": "No IAM wildcard Actions or Resources"
    }
  },
  "spec": {
    "rules": [
      {
        "name": "no-wildcard-action",
        "assert": {
          "all": [
            {
              "check": {
                "planned_values": {
                  "root_module": {
                    "~.resources": {
                      "(type == 'aws_iam_policy' && contains(values.policy_document.Statement[].Action, '*'))": false
                    }
                  }
                }
              }
            }
          ]
        }
      },
      {
        "name": "no-wildcard-resource",
        "assert": {
          "all": [
            {
              "check": {
                "planned_values": {
                  "root_module": {
                    "~.resources": {
                      "(type == 'aws_iam_policy' && contains(values.policy_document.Statement[].Resource, '*'))": false
                    }
                  }
                }
              }
            }
          ]
        }
      }
    ]
  }
}