bug(terraform): iam_policy_allows_for_data_exfiltration is too restrictive

[david-mnz]

iam_policy_allows_for_data_exfiltration is too restrictive, The is_illegal() function only evaluates the Action, not the Resource. So any IAM statement containing secretsmanager:GetSecretValue will trigger a violation, regardless of whether you specify:
• A specific secret ARN
• A wildcard resource
• Condition keys

Actual Behavior

This should comply but it doesn’t

data "aws_iam_policy_document" "compliant" {
statement {
effect = "Allow"
actions = [
"secretsmanager:GetSecretValue",
"secretsmanager:DescribeSecret"
]
resources = [
"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-app-secret-abc123",
"arn:aws:secretsmanager:us-east-1:123456789012:secret:my-db-password-xyz789"
]
}
}