Attached customer-managed policy grants no '*:*' access

# Terraform: Managed policy without '*:*' admin privileges
resource "aws_iam_policy" "<example_resource_name>" {
  name   = "<example_resource_name>"
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "iam:GetUser"  # CRITICAL: not "*" or "*:*"; removes admin privileges
      Resource = "*"             # CRITICAL: paired with specific action to avoid full admin
    }]
  })
}

# CloudFormation: Replace admin '*' access with a specific action
Resources:
  <example_resource_name>:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: iam:GetUser  # CRITICAL: removes '*:*' by allowing only a specific action
            Resource: "*"        # CRITICAL: no full admin since Action is not '*'