IAM policies should not allow full "*" administrative privileges

How to fix it

Have the default version of every customer managed policy free of a statement that combines Effect Allow with Action "*" and Resource "*". Two end states clear it: narrow the statement to the actions and resources actually needed, or delete the policy, which first means detaching it from every user, group and role that carries it and deleting its non-default versions. Read what the check reads before editing: only the default version of policies you created, so a change to a non-default version does nothing, and inline and AWS managed policies are never examined. A wildcard inside a list counts exactly as a bare one, so an Action of ["*", "s3:GetObject"] fails; a service wildcard such as "s3:*" is a different control and is not flagged here; and a Condition on the statement does not exempt it, nor does the policy being used only as a permissions boundary. Promoting a new version takes effect immediately for every identity the policy is attached to, so check the policy's last-accessed data first to see who would lose what. A managed policy keeps at most five versions, and the sixth is rejected until an older one is deleted.

In the console

IAM → Policies → the policy → Permissions → Edit

With the AWS CLI

aws iam create-policy-version --policy-arn <policy-arn> --policy-document file://policy.json --set-as-default

With Terraform

resource "aws_iam_policy" "this" {
  name = var.policy_name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:GetObject"]
      Resource = [var.bucket_objects_arn]
    }]
  })
}