A great resource of various types of sensitive keys can be found here: https://gist.github.com/EdOverflow/8bd2faad513626c413b8fc6e9d955669

This answer on Stack Overflow might be a good starting point.

Do not allow action “*” or resources “*” in an IOT Policy

Example policies are here: https://docs.aws.amazon.com/iot/latest/developerguide/example-iot-policies.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iot-policy.html
https://www.terraform.io/docs/providers/aws/r/iot_policy.html

Is your feature request related to a problem? Please describe.
We tried goverall but faced issues with controlling the configuration.
For example, when removing a simple binary during thoughtworks/talisman#234 , the code coverage dropped. And we couldn't find a way to exclude files.

Describe the solution you'd like
Implement a code coverage tool, such as, code

• terrascan version: v1.3.0
• Operating System:

Description

The release process should create a docker container with release version tag.
It becomes easy for the users to download the docker image for a specific terrascan release.