Custom IAM policy blocks wildcard STS role assumption

# Terraform: Replace wildcard resource with a specific role ARN
resource "aws_iam_policy" "<example_resource_name>" {
  name   = "<example_resource_name>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "sts:AssumeRole"
      Resource = "arn:aws:iam::<example_account_id>:role/<example_resource_name>" // CRITICAL: restrict to a specific role ARN to remove wildcard
    }]
  })
}

# CloudFormation: Replace wildcard resource with a specific role ARN
Resources:
  <example_resource_name>:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Resource: arn:aws:iam::<example_account_id>:role/<example_resource_name>  # CRITICAL: restrict to a specific role ARN to remove wildcard