Ensure policy with iam:Passrole/* action and NotResource attributes is not used

Using the iam:PassRole/* action with NotResource can be overly permissive because it can allow iam:PassRole permissions on multiple resources. We recommend that you specify resource ARNs instead.

In AWS Console -

1. Sign in to the AWS console and go to the IAM console.
2. In the Navigation pane, select Policies.
3. In the list of policies, select the policy to edit.
4. Select the Permissions tab, and then choose Edit policy.
5. On the review page, review the changes and click Save.

In Terraform -

1. In the aws_iam_policy, aws_iam_role_policy, aws_iam_group_policy, and aws_iam_user_policy resources, when using the iam:PassRole action edit the policy field so that NotResource is not used.
2. Update the Resource ARN list to use specific IDs rather than a wildcard.
   For more information on how to effectively write an IAM policy see the AWS and Terraform documentation.

References:
https://docs.aws.amazon.com/IAM/latest/UserGuide/service_code_examples_iam.html
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy