What the linter checks, and why that's a narrow slice of real evaluation

AWS IAM's actual permission evaluation logic is genuinely complex — it combines identity-based policies, resource-based policies, permission boundaries, service control policies, and session policies, with explicit denies overriding every allow regardless of where they come from. This tool doesn't attempt to replicate any of that; it reads a single policy document in isolation and flags a couple of well-known red flags — full wildcard Allow statements, wildcard service actions paired with wildcard resources, missing Sids — that are worth a second look on their own merits. A policy that passes this check clean can still be part of an over-permissive setup once combined with everything else attached to the same principal; this tool is a fast first pass, not a substitute for an actual access review.

Why Action="*" + Resource="*" is worth flagging specifically

That exact combination is IAM's literal spelling for "allow everything, on everything" — full administrative access with no scoping at all. It shows up more often than it should, usually not because someone intended to grant full admin, but because a policy was drafted quickly (often by copying an example from documentation) and never scoped down before being attached to a real role. Because it's such an unambiguous, high-blast-radius pattern, it's exactly the kind of thing worth a linter catching automatically rather than relying on someone noticing it during a manual policy review.