Question

You told an AI "give the Lambda permission to decrypt with our KMS key and read the uploads bucket." It produced this IAM policy. It works and the Lambda runs. A cloud-security review fails it. What's over-scoped, and what's the subtle correctness risk?

1resource "aws_iam_role_policy" "lambda" {2  role = aws_iam_role.lambda.id3  policy = jsonencode({4    Version = "2012-10-17"5    Statement = [{6      Effect   = "Allow"7      Action   = ["kms:*", "s3:*"]8      Resource = "*"9    }]10  })11}