IAM customer managed policies that you create should not allow wildcard actions for services

How to fix it

• Can break clients: The new default version applies at once to every user, group and role holding the policy, so check its last-accessed data for actions still in use first.
• Affects another check: A statement allowing Action * on Resource * also fails IAM.1; replacing the * with specific actions clears both.

In the console

IAM → Policies → the policy → Permissions → Edit

Action

Only the actions needed, or a prefix with a wildcard such as ec2:Describe*; never service:* or *

NotAction

Not service:* or * in an Allow statement; list the allowed actions under Action instead

Set this new version as the default

Left selected (it is by default); only the default version is read

With the AWS CLI

aws iam create-policy-version --policy-arn <policy-arn> --policy-document file://policy.json --set-as-default

With Terraform

resource "aws_iam_policy" "this" {
  name = var.policy_name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["ec2:DescribeInstances", "ec2:DescribeTags"]
      Resource = ["*"]
    }]
  })
}