Admin-level grants in Terraform

This rule flags IAM, grant, role and policy resources that grant an admin-level role as a literal value. Those are roles/owner, roles/editor, ACCOUNTADMIN, SECURITYADMIN, SYSADMIN, ALL PRIVILEGES, * and the AWS AdministratorAccess policy. A role set from a variable reads as unknown and is not flagged.

Whoever holds the grant can read, change or delete any data in scope. They can also grant the same access to others.

Narrow the admin-level grants in Terraform. Grant the narrowest role the job needs, such as a dataset-level reader. Keep admin roles for break-glass accounts.

Before:

resource "google_project_iam_member" "analysts" {
  project = var.project_id
  role    = "roles/editor"
  member  = var.analyst_group
}

After:

resource "google_bigquery_dataset_iam_member" "analysts" {
  dataset_id = var.marts_dataset
  role       = "roles/bigquery.dataViewer"
  member     = var.analyst_group
}

A break-glass account needs admin rights. So can the identity Terraform itself runs as in a bootstrap stack. Keep those few grants together, with a comment saying why. Tell us, and the finding comes out of your report.

The .tf files you supply. We refuse .tfvars and state files by name, and read only literal values from each resource. With no grant resource declared, the rule does not apply.