Admin policy not using a Resource of *

Why is `Admin policy not using a Resource of *` a risk?

The code that generates it is at https://github.com/duo-labs/cloudmapper/blob/5fdd99bc3b56210baf846588d0973bdfe3c71298/commands/find_admins.py#L59

The policy is:

```
{
"Action": [
"iam:*"
],
"Effect": "Allow",
"Resource": [
"arn:aws:iam::012345673610:role/esquare-lambda-dev",
"arn:aws:iam::012345673610:role/esquare-lambda-prd"
]
},
```

My understanding is that the user with this policy will be able to perform `iam:*` on those two resources, and nothing more. There are risks associated with that: privilege escalation via changes to those resources.

Am I missing something else that is related with the finding? For example, will this policy allow the user associated with it create a new user (that call doesn't have a resource associated with it and is allowed by `iam:*`)

If this is a false positive, maybe the code should be updated?