title: Giving an IAM User full access
body: <p>Should an IAM User say called User1 be given full access like so:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": "*",
        "Resource": "*"
      }
    ]
  }
  </code></pre>
  
  <p>Could it also be used to create Amazon API calls? Is this a security risk or should I create another user just to access the Amazpn API Gateway?</p>