An instance of this went unreported by cfn-lint, despite being errored at deployment time https://docs.aws.amazon.com/IAM/latest/UserGuide/access-analyzer-reference-policy-checks.html#access-analyzer-reference-policy-checks-error-unsupported-wildcard-in-principal