---
title: "block-wildcard-iam"
description: "Pre-commit gate for the mechanizable slice of ASI03, one line at a time: a wildcard action, resource or principal in string or list form, any quote style (JSON, YAML, Terraform, CDK, escaped JSON), whole-service wildcard"
canonical: https://agentpluginsdirectory.com/plugins/block-wildcard-iam
last-updated: 2026-10-03
---

# block-wildcard-iam
Pre-commit gate for the mechanizable slice of ASI03, one line at a time: a wildcard action, resource or principal in string or list form, any quote style (JSON, YAML, Terraform, CDK, escaped JSON), whole-service wildcards on s3, iam, sts, kms and ec2 actions, Allow with an inverted key, administrator, power-user and IAM-admin managed policies, GCP owner and editor roles and public members, Kubernetes RBAC wildcards and cluster-admin, Azure wildcard actions and Owner. Only a one-line strict-JSON AWS Deny statement is exempt. Friction, not a security boundary: grants split across lines (iam-policy-scan reads those), partial wildcards, unlisted services and roles, YAML aliases or tags and runtime-built grants pass; other Deny forms and admission-webhook wildcards are refused. Escape: 'pragma: allowlist broad-privilege' on the same line, honoured at commit; at agent tool-use only when that exact line is already committed in HEAD.
- Slug: block-wildcard-iam
- Publisher: chock-core
- Repository: https://github.com/open-coder-ai/chock-catalog
- Manifest: agentic-security/block-wildcard-iam/plugin.json
- Version: 0.1.1
- License: Apache-2.0
- Category (editorial): security
- Skills: 1 (block-wildcard-iam)
- MCP servers: 0
- Stars: 3
- Repository created: 2026-08-17
- Repository last pushed: 2026-10-03
- Publisher type: Organization
- Listing: https://agentpluginsdirectory.com/plugins/block-wildcard-iam
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## Skills

- block-wildcard-iam: Pre-commit gate for the mechanizable slice of ASI03: wildcard Action or Resource in IAM policy documents, AdministratorAccess attachment, GCP roles/owner or roles/editor, and Terraform wildcard action/resource lists. An agent's identity design stays with the advisory owasp-asi03 policy; this blocks…

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.