The time it was wrongand the time it wasn’t

It was wrong

A wildcard that had to be a wildcard

It flagged Resource = "*" in an IAM policy as overbroad. Usually that’s a fair catch — it’s the most common finding any linting tool makes.

Not here. That AWS action doesn’t support resource-level permissions at all, so "*" is the only value it accepts. Narrowing it wouldn’t have made the policy safer. It would have made it invalid.

I checked the service authorization reference rather than arguing from memory, then looked at where the boundary actually lived — the OIDC trust conditions on the role. Already tight.

So I dismissed it and wrote down why. Not “false positive” — the real reason, in the pull request, so the next person doesn’t redo the research.

It was right

A database nobody said to keep private

A change created an RDS instance in valid, working Terraform that never set publicly_accessible. Nothing was syntactically wrong. The requirement simply wasn’t expressed anywhere in the code.

A human review would probably have passed it — you skim a diff, you don’t re-read the acceptance criteria line by line.

I hit that gap, so I encoded it. My rds-terraform-provisioner skill now carries it as a gotcha: requirements go quiet on that setting, so set it explicitly rather than inheriting whatever the default happens to be.