A policy that grants all permissions may indicate an improper access control, which violates the principle of least privilege. Suppose an identity is granted full permissions to a resource even though it only requires read permission to work as expected. In this case, an unintentional overwriting of resources may occur and therefore result in loss of information.

Ask Yourself Whether

Identities obtaining all the permissions:

There is a risk if you answered yes to any of those questions.

Recommended Secure Coding Practices

It’s recommended to apply the least privilege principle, i.e. by only granting the necessary permissions to identities. A good practice is to start with the very minimum set of permissions and to refine the policy over time. In order to fix overly permissive policies already deployed in production, a strategy could be to review the monitored activity in order to reduce the set of permissions to those most used.

Noncompliant Code Example

A customer managed policy that grants all permissions by using the wildcard (*) in the Action property:

MyPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
        PolicyDocument:
            Version: "2012-10-17"
            Statement:
                - Effect: Allow
                Action:
                    - "*" # Sensitive
                Resource:
                    - !Ref MyResource
        Roles:
            - !Ref MyRole

Compliant Solution

A customer managed policy that lists and grants only the required permissions:

MyPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
        PolicyDocument:
            Version: "2012-10-17"
            Statement:
                - Effect: Allow
                Action:
                    - "s3:GetObject"
                Resource:
                    - !Ref MyResource
        Roles:
            - !Ref MyRole

See