IAM policies should not allow full "*" administrative privileges

How to fix it

• Can break clients: The new default version applies at once to every user, group and role holding the policy, so check its last-accessed data for actions still in use first.
• Affects another check: This statement also fails IAM.21, which ignores Resource: replacing the * with specific actions clears both, while narrowing only Resource leaves IAM.21 failing.

In the console

IAM → Policies → the policy → Permissions → Edit

Action

Only the actions needed, not * (even inside a list); a service wildcard such as s3:* passes here

Resource

Only the resources needed; a statement passes once its Action or Resource is no longer *

Set this new version as the default

Left selected (it is by default); only the default version is read

With the AWS CLI

aws iam create-policy-version --policy-arn <policy-arn> --policy-document file://policy.json --set-as-default

With Terraform

resource "aws_iam_policy" "this" {
  name = var.policy_name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject"]
      Resource = [var.bucket_objects_arn]
    }]
  })
}