IAM customer managed policies that you create should not allow wildcard actions for services

How to fix it

Replace any Allow statement that grants a whole service, written as ec2:* or as NotAction with the same value, with the specific actions needed. A prefixed wildcard such as ec2:Describe* passes and is the recommended way to group related actions, so adding the prefix is usually the whole fix. Only customer managed policies at their default version are read, so editing any other version changes nothing. Promoting a new version takes effect immediately for every identity the policy is attached to.

In the console

IAM → Policies → the policy → Permissions → Edit

With the AWS CLI

aws iam create-policy-version --policy-arn <policy-arn> --policy-document file://policy.json --set-as-default

With Terraform

resource "aws_iam_policy" "this" {
  name = var.policy_name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["ec2:DescribeInstances", "ec2:DescribeTags"]
      Resource = ["*"]
    }]
  })
}