Principle of Least Privilege IAM

Explain least privilege for cloud IAM. Give an example of a bad vs good policy for an app reading one S3 prefix.

Answers use simple, clear English.