text: from checkov.cloudformation.checks.resource.base_resource_check import BaseResourceCheck
  from checkov.common.models.enums import CheckResult, CheckCategories
  from checkov.common.util.type_forcers import force_list
  
  class IAMStarActionPolicyDocument(BaseResourceCheck):
      def __init__(self):
          name = "Ensure no IAM policies documents allow \"*\" as a statement's actions"
          id = "CKV_AWS_63"
          supported_resources = ['AWS::IAM::Policy','AWS::IAM::Group','AWS::IAM::Role','AWS::IAM::User']
          categories = [CheckCategories.IAM]
          super().__init__(name=name, id=id, categories=categories, supported_resources=supported_resources)
  
      def scan_resource_conf(self, conf):
          myproperties=conf['Properties']
          type = conf['Type']
  
          #catch for inline policies
          if type != 'AWS::IAM::Policy':
               if 'Policies' in myproperties.keys():
                  policies=myproperties['Policies']
                  if len(policies) > 0:
                      for policy in policies:
                          result=check_policy(policy['PolicyDocument'])
                          if result==CheckResult.FAILED:
                             return result
                      return CheckResult.PASSED
                    # not empty and had non failing policies
                  return CheckResult.UNKNOWN
          #this is just for Policy resources
          if 'PolicyDocument' in myproperties.keys():
              return check_policy(myproperties['PolicyDocument'])
          return CheckResult.UNKNOWN
  
  
  check = IAMStarActionPolicyDocument()
  
  def check_policy(policy_block):
      if policy_block and 'Statement' in policy_block.keys():
          for statement in force_list(policy_block['Statement']):
              if 'Action' in statement and statement.get('Effect', ['Allow']) == 'Allow' and '*' in force_list(statement['Action']):
                  return CheckResult.FAILED
              return CheckResult.PASSED
      else:
          return CheckResult.PASSED
  
  
          