Question about specificity in wildcards. about cloudformation-guard HOT 4 CLOSED

AWSTemplateFormatVersion: "2010-09-09"

Resources:
  rS3FullFolderName:
    Type: AWS::IAM::Role
    Properties:
      RoleName: s3_full_folder_name
      Description: Testing use of folder name
      PermissionsBoundary: "permissionboundary"
      MaxSessionDuration: 36000
      Policies:
        - PolicyName: s3_full_folder_name_check
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:List*
                Resource:
                  - !Sub arn:aws:s3:::lly-edp-raw-us-east-2-${DeployEnvironment}/veeva_cdb*/

AWSTemplateFormatVersion: "2010-09-09"

Resources:
  rS3FullFolderName:
    Type: AWS::IAM::Role
    Properties:
      RoleName: s3_full_folder_name
      Description: Testing use of folder name
      PermissionsBoundary: "permissionboundary"
      MaxSessionDuration: 36000
      Policies:
        - PolicyName: s3_full_folder_name_check
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - s3:List*
                Resource:
                  - !Sub arn:aws:s3:::lly-edp-raw-us-east*-2-${DeployEnvironment}/veeva_cdb/

rule IAM_ROLE_NO_FULL_ACCESS_FOR_S3 {
  let violationsString = Resources.*[
    Type in [/AWS::IAM::Role/]
    some Properties.Policies[*].PolicyDocument.Statement[*] {
      some Resource[*] in [/^arn:aws:s3:::([^*\/]*\*[^*\/]*)\/.*$/]
    }
  ]
  let violationsSub = Resources.*[
    Type in [/AWS::IAM::Role/]
    some Properties.Policies[*].PolicyDocument.Statement[*] {
      some Resource[*][keys == "Fn::Sub"] in [/^arn:aws:s3:::([^*\/]*\*[^*\/]*)\/.*$/]
    }
  ]
  %violationsString empty
  <<
    Violation: Wildcard (*) detected in the bucket name portion of the S3 ARN.
    Fix: Avoid using wildcards in the bucket name portion of the S3 ARN.
  >>
  %violationsSub empty
  <<
    Violation: Wildcard (*) detected in the bucket name portion of the S3 ARN.
    Fix: Avoid using wildcards in the bucket name portion of the S3 ARN.
  >>
}