IAM Structural Audit

Audit one IAM policy and report what widens it. The findings that need the document read as a whole: a wildcard action together with a wildcard resource, which means more than either alone; a Deny whose resource patterns no Allow in the policy covers, so it constrains nothing it appears to; and NotAction or NotResource in an Allow, which defines the permitted set by exclusion so the policy widens whenever the cloud gains an action, without the document changing.