IAM
The rulebook that says who can do what in your AWS account.
IAM (Identity and Access Management) is the AWS service that controls permissions. Every action in AWS (reading a file in Amazon S3, starting an Amazon EC2 instance, deleting a database) is checked against IAM first: who is asking, and are they allowed? By default the answer is no; you grant permissions explicitly.
It has three main pieces. Users are people or programs with their own credentials. Roles are sets of permissions that something can take on temporarily: an AWS Lambda function, an EC2 instance, a person from another account. Policies are JSON documents that list what is allowed, for example 'allow s3:GetObject on the bucket invoices and nothing else'. You attach policies to users, groups or roles.
Why it matters: most cloud security incidents are not clever hacks but leaked keys with too many permissions. The habit IAM encourages is least privilege: give each person and each program exactly what it needs. A reporting script should be able to read one bucket, not wipe the account.
Keep in mind
- Everything is denied until a policy explicitly allows it.
- Prefer roles over long-lived access keys; roles hand out temporary credentials.
- Protect the root user with MFA and almost never use it.
- IAM is free and comes with every AWS account.
