Security, Identity, and Compliance
AWS Identity and Access Management (IAM)
The AWS service for controlling who is authenticated and what actions identities can perform on AWS resources.
Key points
- IAM users, groups, roles, and policies support access control within and across accounts.
- Policies define permissions; least privilege grants only the actions and resources that are needed.
- Roles provide temporary credentials and are preferred to distributing long-lived access keys.
Best-known use cases
- Grant workload or human access to AWS resources.
- Delegate cross-account access without sharing credentials.
What candidates often confuse it with
- Authentication proves identity; authorization evaluates permissions.
- IAM controls AWS resource access; IAM Identity Center centralizes workforce access across accounts and applications.
- The root user is not an ordinary IAM user and should not be used for daily administration.
Key Cloud Practitioner takeaway
Use IAM policies and roles for least-privileged AWS access; protect the root user separately.
Related services
- AWS IAM Identity Center
- AWS Secrets Manager
Relevant exam tasks
- D2.3