Motivation

On large Terraform repositories, the IAM privilege-escalation rule family was a major scan bottleneck. Each rule rebuilt dangerous-permission sets by resolving policy_arn attachments with an O(attachments × documents) document rescan. This is a followup of #221, which improved these queries, but there was a bigger improvement possible.

Changes

IAM helpers (common.rego)

Build _policy_name_wildcard_perms once per query in a single pass over managed policy resources. Attachment branches for roles, users, and groups now resolve policy_arn references via membership in that set instead of rescanning every document for each attachment.

Tests

Add regression coverage for inline policies, cross-document attachment resolution, and non-wildcard policy exclusion.

Author Checklist

• I have reviewed my own PR.
• I have added or updated relevant unit tests where necessary. If no tests are added, I've explained why.
• All new and existing tests pass.
• I have tested my changes on staging (if applicable).
• I have updated any relevant documentation (if applicable).

QA Instruction

1. opa test assets/libraries/ --v1-compatible
2. Build the scanner and scan a large Terraform repo with many IAM roles and policy attachments.
3. Confirm privilege-escalation rules no longer appear in slow-rule logs and total scan time drops materially.

On cloud-inventory (29,788 files, full rule corpus): scan time dropped from ~8m to ~1m53s, with 0 slow IAM privilege-escalation rules (previously 19 rules at ~3 min each).

Blast Radius

Affects Terraform IAM privilege-escalation rules that use *_unrecommended_permission_policy_scenarios in common.rego. No CLI or engine behavior changes.

Additional Notes

N/A

I submit this contribution under the Apache-2.0 license.