How to Apply AWS IAM Least Privilege to an Over-Permissive Policy

The problem with wildcard IAM policies

A policy like this is common in early setups and terrifying in production:

{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*"
}

If the credentials attached to this policy are ever exposed - in a log file, an environment variable, a misconfigured S3 bucket - an attacker has full control of the account. AWS Access Analyzer and security audits flag this immediately.

Write a least-privilege policy in Terraform

The deployer role only needs to read objects from one S3 bucket. Scope the policy to exactly that:

resource "aws_iam_policy" "deployer" {
  name = "deployer-policy"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "s3:GetObject"
      Resource = "arn:aws:s3:::app-artifacts/*"
    }]
  })
}

Action is now a single string (s3:GetObject) instead of "*", and Resource is the specific bucket prefix ARN instead of "*". The deployer can do exactly one thing on exactly one resource.

Verify the policy after applying

After terraform apply, confirm the live policy document matches what you intended:

terraform apply -auto-approve

aws iam get-policy-version \
  --policy-arn $(terraform output -raw policy_arn) \
  --version-id v1 \
  --query 'PolicyVersion.Document'

The output should show "Action": "s3:GetObject" and the specific ARN - not wildcards.

How to scope any IAM policy

• Start from zero - list what the workload actually does, then add only those permissions. Never start from "*" and prune.
• Scope the Resource ARN - use the full ARN of the specific bucket, table, secret, or queue. Append /* only when item-level access is needed (S3 objects, not the bucket itself).
• Use IAM Access Advisor - in the AWS console, the Access Advisor tab on a role shows which services it actually used in the last 90 days. Anything not listed is a candidate to remove.
• Use AWS Access Analyzer - generates a least-privilege policy from CloudTrail logs so you can iterate: deploy permissive, log real usage, tighten to what was actually called.