A Terraform module input that was never set defaulted to an empty string. Joined to a bucket ARN prefix and a wildcard, it produced a policy that Sergey Shinder says granted a reporting service read access to every bucket in the account—not just the two intended. His account shows why module reviews need to examine what inputs mean when absent and what the rendered policy actually permits.
How an unset input widened access
In a first-person account published September 20, 2026, Sergey Shinder describes a pull request intended to grant a reporting service read access to two storage buckets. The module constructed a policy resource by combining a bucket ARN prefix, an input variable meant to contain a team prefix, and an asterisk. In the affected workspace, the input had never been set and its default was an empty string. The resulting expression was the bare ARN root followed by a wildcard. Shinder says that matched every bucket in the account. Shinder’s account
As an Amazon Associate I earn from qualifying purchases.
The policy reportedly remained in place for five weeks before a quarterly access review caught it. That duration is specific to this incident; it is not a general measure of how long such errors go unnoticed.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Why the change passed review
The plan displayed the policy as a long, escaped JSON string on one line. Shinder says the old-to-new difference amounted to eight characters disappearing from the middle of that string. Two reviewers approved the change. The underlying problem was not simply that the policy was hard to read: the presentation made it difficult to recognize that removing an empty component left the broad wildcard intact.
#1 Best Overall
What the author changed
Shinder reports three safeguards implemented after the incident. They act at different points in the workflow; his account describes what his team did, not independently tested guarantees for every Terraform or AWS policy design.
| Safeguard | Where it acts | Failure it is intended to catch |
|---|---|---|
| Reject a prefix shorter than four characters | Input validation | An absent or too-short prefix that could otherwise pass into policy construction |
| Build ARNs from an explicit list of names instead of string interpolation | Resource construction | Concatenation that leaves a universal wildcard when an input is empty; the author says an empty list now produces an empty policy |
| Decode plan policy documents into readable statement rows and fail on a resource ending in a bare wildcard unless an exception is recorded | Plan review in the pipeline | An unexpectedly broad resource pattern that is difficult to spot in escaped JSON |
These changes are layered rather than interchangeable: validation checks an input, explicit resource construction changes how permitted names are represented, and the pipeline inspects the resulting plan. The reported wildcard check also allows exceptions, making their recording and review part of the safeguard rather than treating every broad pattern as automatically acceptable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to apply the lesson to a module review
- Inspect the absent-input case. Check the module default and evaluate the result when the input is omitted or empty, not only when a caller supplies the expected prefix.
- Follow the final resource expression. A wildcard does not become narrow merely because it is adjacent to a variable. If that variable contributes nothing, the wildcard may remain broad.
- Review rendered policy semantics. Make statements and resource patterns readable in plan review so that a small string change cannot conceal a large permission change.
- Choose construction that matches the design. Where the module is meant to allow named resources, an explicit list can make the permitted set visible and avoid relying on string assembly.
- Automate checks for broad patterns. Fail on unexpected wildcards and require exceptions to be deliberate and reviewable.
As Shinder puts it: “The habit I would pass on is to ask what each variable means when it is absent, not when it is filled in.”
Quick Recap
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
