Default Rule List
All rules included in the IAM Armor open-source default rule pack.
Rule Catalog
Ten built-in rules ship with iamarmor. Use these defaults as your baseline, then tune severities in .iamarmor.yml.
High severity
No Action wildcard
Blocks wildcard actions that grant unconstrained IAM permissions.
Category: Least privilegeNo wildcard resource with sensitive actions
Flags risky action/resource combinations such as destructive APIs against *.
No iam:PassRole on wildcard resource
Prevents pass-role escalation when all resources are allowed.
Category: Privilege escalationNo wildcard principal
Disallows broad principals in resource-based policies.
Category: Trust boundariesRequire concrete assume-role principal
Enforces explicit principals in assume_role_policy statements.
No AdministratorAccess attachment
Detects direct attachment of the AWS managed AdministratorAccess policy.
Medium severity
No inline policies
Recommends managed policies to improve reuse, reviewability, and audit trails.
Category: Policy managementNo NotAction in allow statements
Avoids broad implicit grants caused by inverse action matching.
Category: Policy logic safetyNo NotResource in allow statements
Prevents accidental permission expansion caused by inverse resource matching.
Category: Policy logic safetyLow severity
Require max_session_duration
Encourages explicit role session boundaries for stronger runtime controls.
Category: Session hardeningFor examples and rationale, see STARTER_RULES.md.