Check ID: iam_inline_policy_no_wildcard_marketplace_subscribe
Provider: AWS
Service: iam
Severity: MEDIUM
Categories: gen-ai, identity-access
Resource type: AwsIamPolicy

​
What this check verifies

IAM inline policies are analyzed to identify statements that grant aws-marketplace:Subscribe on all resources (*). This action controls the ability to subscribe to AWS Marketplace products, including Amazon Bedrock foundation models, and should be scoped to specific product ARNs to enforce least privilege.

​
Risk

Granting aws-marketplace:Subscribe on all resources via inline policies allows subscribing to any Marketplace product, including expensive Bedrock foundation models, leading to uncontrolled costs, shadow AI usage, and compliance violations.

​
Recommendation

Replace Resource: "*" with specific, approved AWS Marketplace product ARNs. Prefer managed policies over inline and apply the principle of least privilege to aws-marketplace:Subscribe permissions to prevent unauthorized subscriptions to costly Bedrock models and other Marketplace products.

​
Remediation

resource "aws_iam_role_policy" "scoped_marketplace_subscribe" {
  name = "scoped-marketplace-subscribe"
  role = aws_iam_role.example.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["aws-marketplace:Subscribe"]
      Resource = ["arn:aws:aws-marketplace::123456789012:product/approved-product-id"]  # FIX: scope to specific products
    }]
  })
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_inline_policy_no_wildcard_marketplace_subscribe. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks