IAM Structural Audit

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "amount": "200000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 60
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "body": {
          "policy": "{\n \"Version\": \"2008-10-17\",\n \"Statement\": [\n  {\n   \"Sid\": \"Admin\",\n   \"Effect\": \"Allow\",\n   \"Action\": \"*\",\n   \"Resource\": \"*\"\n  },\n  {\n   \"Sid\": \"AllButBilling\",\n   \"Effect\": \"Allow\",\n   \"NotAction\": [\n    \"aws-portal:*\"\n   ],\n   \"Resource\": [\n    \"arn:aws:s3:::reports/*\"\n   ]\n  },\n  {\n   \"Sid\": \"IamWide\",\n   \"Effect\": \"Allow\",\n   \"Action\": [\n    \"iam:*\"\n   ],\n   \"Resource\": [\n    \"arn:aws:iam::123456789012:role/app\"\n   ]\n  },\n  {\n   \"Sid\": \"DenyElsewhere\",\n   \"Effect\": \"Deny\",\n   \"Action\": [\n    \"s3:*\"\n   ],\n   \"Resource\": [\n    \"arn:aws:s3:::other-account-bucket/*\"\n   ]\n  }\n ]\n}"
        },
        "type": "http",
        "method": "POST",
        "bodyType": "json"
      },
      "output": {
        "type": "json",
        "example": {
          "limits": {
            "maxEnvBytes": 131072,
            "maxFindings": 500,
            "maxPlanBytes": 4194304,
            "maxResources": 5000,
            "maxStatements": 500,
            "maxPolicyBytes": 262144
          },
          "passed": false,
          "bounded": false,
          "version": "2008-10-17",
          "complete": true,
          "findings": [
            {
              "code": "VERSION_NOT_CURRENT",
              "detail": "The policy declares Version \"2008-10-17\". Anything other than 2012-10-17 disables policy variables and some condition operators without saying so."
            },
            {
              "code": "ALLOW_WILDCARD_ACTION_AND_RESOURCE",
              "detail": "Admin allows * on every resource. An action wildcard with a resource wildcard is the whole of what the principal can reach, which is different from either wildcard on its own.",
              "statement": "Admin"
            },
            {
              "code": "WILDCARD_WITHOUT_CONDITION",
              "detail": "Admin uses a wildcard and declares no Condition, so nothing narrows it at evaluation time.",
              "statement": "Admin"
            }
          ],
          "deny_count": 1,
          "request_id": "example-request",
          "service_id": "iam_policy_structural_audit",
          "statements": [
            {
              "sid": "Admin",
              "effect": "Allow",
              "action_count": 1,
              "has_condition": false,
              "principal_count": 0,
              "uses_not_action": false,
              "wildcard_action": true,
              "uses_not_resource": false,
              "wildcard_resource": true
            },
            {
              "sid": "AllButBilling",
              "effect": "Allow",
              "action_count": 0,
              "has_condition": false,
              "principal_count": 0,
              "uses_not_action": true,
              "wildcard_action": false,
              "uses_not_resource": false,
              "wildcard_resource": false
            },
            {
              "sid": "IamWide",
              "effect": "Allow",
              "action_count": 1,
              "has_condition": false,
              "principal_count": 0,
              "uses_not_action": false,
              "wildcard_action": true,
              "uses_not_resource": false,
              "wildcard_resource": false
            }
          ],
          "allow_count": 3,
          "assumptions": [
            "An action wildcard together with a resource wildcard is reported as its own finding, because neither on its own means what the pair means.",
            "NotAction and NotResource in an Allow are reported because they define the permitted set by exclusion, so the policy widens whenever the cloud gains an action or the account gains a resource, without ...",
            "ARN and action patterns are matched with a non-backtracking sweep, so a pattern supplied by a caller cannot make matching expensive."
          ],
          "limitations": [
            "The policy document supplied. What it is attached to, which other policies apply, and what a permission boundary or an organisation policy allows are all outside this. Not a security assessment or a c...",
            "bounded is true only when every statement was read and nothing widened the policy in the ways reported."
          ],
          "observed_at": "2026-10-02T00:00:00.000Z",
          "not_examined": [],
          "finding_count": 7,
          "service_version": "1.0.0",
          "statement_count": 4,
          "findings_by_code": {
            "VERSION_NOT_CURRENT": 1,
            "ALLOW_USES_NOT_ACTION": 1,
            "ALLOW_WILDCARD_ACTION": 1,
            "WILDCARD_WITHOUT_CONDITION": 2,
            "ALLOW_WILDCARD_ACTION_AND_RESOURCE": 1,
            "ALLOW_WILDCARD_ON_PRIVILEGE_SERVICE": 1
          },
          "wildcard_statement_count": 3,
          "conditions_required_on_wildcards": true
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "properties": {
            "body": {
              "type": "object",
              "required": [
                "policy"
              ],
              "properties": {
                "policy": {
                  "type": "string",
                  "maxLength": 262144
                },
                "require_conditions_on_wildcards": {
                  "type": "boolean"
                }
              },
              "additionalProperties": false
            },
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "POST"
              ],
              "type": "string"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog

2026-10-04 08:28Z

Last indexed by Roundhouse

2026-10-05 00:20Z

Last enriched (probe, favicon, geo)

2026-10-05 16:46Z

x402 version

2

Max timeout

60s

Liveness probe

HTTP 0