Repository: bridgecrewio/checkov

Issue:
Add new check: IAM Policy should follow least privilege
Do not allow a policy with action or resource of `“*”`
Ensure this covers both IAM Policies and Managed Policies

https://www.terraform.io/docs/providers/aws/r/iam_policy.html
https://www.terraform.io/docs/providers/aws/d/iam_policy_document.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html



Discussion:
@jonjozwiak I'm not sure having resource = "*" is a bad idea
And by `IAM Policies and Managed Policies` do you mean `inline policies and managed policies`?

Resolving patch:
diff --git a/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
new file mode 100644
--- /dev/null
+++ b/checkov/terraform/checks/data/aws/StarActionPolicyDocument.py
@@ -0,0 +1,28 @@
+from checkov.terraform.checks.data.base_check import BaseDataCheck
+from checkov.common.models.enums import CheckResult, CheckCategories
+
+
+class StarActionPolicyDocument(BaseDataCheck):
+    def __init__(self):
+        name = "Ensure no IAM policies documents allow \"*\" as a statement's actions"
+        id = "CKV_AWS_49"
+        supported_data = ['aws_iam_policy_document']
+        categories = [CheckCategories.IAM]
+        super().__init__(name=name, id=id, categories=categories, supported_data=supported_data)
+
+    def scan_data_conf(self, conf):
+        """
+            validates iam policy document
+            https://learn.hashicorp.com/terraform/aws/iam-policy
+        :param conf: aws_kms_key configuration
+        :return: <CheckResult>
+        """
+        key = 'statement'
+        if key in conf.keys():
+            for statement in conf['statement']:
+                if '*' in statement['actions'] and statement['effect'][0] == "Allow":
+                    return CheckResult.FAILED
+        return CheckResult.PASSED
+
+
+check = StarActionPolicyDocument()


Test patch:
diff --git a/tests/terraform/checks/data/aws/test_StarActionPolicyDocument.py b/tests/terraform/checks/data/aws/test_StarActionPolicyDocument.py
new file mode 100644
--- /dev/null
+++ b/tests/terraform/checks/data/aws/test_StarActionPolicyDocument.py
@@ -0,0 +1,33 @@
+import unittest
+
+from checkov.terraform.checks.data.aws.StarActionPolicyDocument import check
+from checkov.common.models.enums import CheckResult
+
+
+class TestStarActionPolicyDocument(unittest.TestCase):
+
+    def test_success(self):
+        resource_conf = {
+            "statement": [{
+                "actions": ["s3:*"],
+                "resources": ["arn:aws:s3:::my_corporate_bucket/*"],
+                "effect": ["Allow"]
+            }]
+        }
+        scan_result = check.scan_data_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.PASSED, scan_result)
+
+    def test_failure(self):
+        resource_conf = {
+            "statement": [{
+                "actions": ["*"],
+                "resources": ["arn:aws:s3:::my_corporate_bucket/*"],
+                "effect": ["Allow"]
+            }]
+        }
+        scan_result = check.scan_data_conf(conf=resource_conf)
+        self.assertEqual(CheckResult.FAILED, scan_result)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/tests/terraform/runner/resources/example/example.tf b/tests/terraform/runner/resources/example/example.tf
--- a/tests/terraform/runner/resources/example/example.tf
+++ b/tests/terraform/runner/resources/example/example.tf
@@ -509,3 +509,49 @@ tags = {
 Name  = "${local.resource_prefix.value}-ec2"
 }
 }
+
+data aws_iam_policy_document "bad_policy_document" {
+  version = "2012-10-17"
+  statement {
+    actions = ["*"]
+    resources = ["*"]
+    effect = "Allow"
+  }
+}
+
+data aws_iam_policy_document "good_policy_document" {
+  version = "2012-10-17"
+  statement {
+    actions = ["s3:Get*"]
+    resources = ["*"]
+    effect = "Allow"
+  }
+}
+
+data aws_iam_policy_document "long_bad_policy_document" {
+  version = "2012-10-17"
+  statement {
+    actions = ["s3:Get*"]
+    resources = ["*"]
+    effect = "Allow"
+  }
+  statement {
+    actions = ["*"]
+    resources = ["*"]
+    effect = "Allow"
+  }
+}
+
+data aws_iam_policy_document "good_deny_policy_document" {
+  version = "2012-10-17"
+  statement {
+    actions = ["*"]
+    resources = ["*"]
+    effect = "Deny"
+    condition {
+      test = "ArnLike"
+      values = ["arn:aws:mock:mock:mock"]
+      variable = "aws:mock"
+    }
+  }
+}