Security, Identity, and Compliance
IAM
AWS Identity and Access Management controls authentication and authorization to AWS APIs through users, roles, policies, and federation. Least-privilege IAM is the decisive boundary for model invocation, data access, and agent tools.
Key points
- Identity and resource policies combine with explicit-deny precedence
- Roles provide temporary credentials for workloads and federated principals
- Condition keys can restrict resources, networks, tags, models, and request context where supported
When to use it
- Limit an application role to approved Bedrock models
- Give each agent action only the data permissions it requires
Exam tips
- Use IAM for AWS API authorization; prompts and Guardrails cannot enforce resource access
- Test policies with real resource ARNs and remember that service-linked execution roles may also require permission