The EC2 findings refers to: AWS Security Group for your EC2 instances have an unknown or too permissive CIDR origin allowed for inbound/outbound traffic. This audit rule expects another Security Group reference as originator or destiny of the traffic that pass through it.
When an unknown CIDR is found, the Unknown CIDR caption is added to the report, which facilitates detection of EC2 security group rules that whitelist network traffic from untrusted IP ranges.
The IAM findings refers to: IAM Role Policy Too Permissive
Inline group policy allows iam:PassRole
Inline role policy allows iam:PassRole *
Inline role policy allows sts:AssumeRole *
NOTE: You've probably set an IA policy something like the ones show below
Ensure that the access policies attached to your IAM roles adhere to the principle of least privilege by giving the roles the minimal set of actions required to perform successfully their task.
Providing the right permissions for your IAM roles will significantly reduce the risk of unauthorized access (through API requests) to your AWS resources and services.
PassRole: To pass a role (and its permissions) to an AWS service, a user must have permissions to pass the role to the service. This helps administrators ensure that only approved users can configure a service with a role that grants permissions. To allow a user to pass a role to an AWS service, you must grant the PassRole permission to the user's IAM user, role, or group.
AssumeRole: A trust policy for the role that allows the service to assume the role. For example, you could attach the following trust policy to the role with the UpdateAssumeRolePolicy action. This trust policy allows Amazon EC2 to use the role and the permissions attached to the role.
AWS Security Audit Open Knowledge bases: