A policy that allows identities to access all resources in an AWS account may violate https://en.wikipedia.org/wiki/Principle_of_least_privilege[the principle of least privilege]. Suppose an identity has permission to access all resources even though it only requires access to some non-sensitive ones. In this case, unauthorized access and disclosure of sensitive information will occur.

