AWS Identity and Access Management

What This Service Solves

IAM is the policy engine for AWS API authorization. It answers who can call which API against which resource under which conditions.

• Use IAM roles for workloads and federated access.
• Use IAM Identity Center for workforce access across accounts.
• Use policies, conditions, permission boundaries, and SCPs to shape access.

When You Should Not Use It

• Do not use IAM users with long-lived keys for application workloads when roles are available.
• Do not treat authentication and authorization as the same thing.

What AWS Manages and What You Manage

AWS runs the IAM control plane. You design identities, policies, trust relationships, credential hygiene, and access reviews.

Security Implications

Least privilege, MFA, role trust policies, explicit denies, Access Analyzer, and CloudTrail review are exam staples.

Availability and Scaling

IAM is global, but policies affect regional resources. A bad policy can create an outage even if the workload is healthy.

IAM scales as a control plane service. Your risk is policy complexity and quota limits rather than server capacity.

Cost Behavior

IAM itself is no-cost. Indirect cost appears when poor access design causes rework, exposure, or overbroad automation.

Common Integrations

• STS
• Organizations
• IAM Identity Center
• KMS
• S3 bucket policies
• Lambda execution roles

How AWS Might Present It

Certification-Specific Depth

Related Comparisons

Sources and Review Metadata

This independent training application is not affiliated with or endorsed by Amazon Web Services. AWS, Amazon Web Services, and AWS certification names are trademarks of Amazon.com, Inc. or its affiliates.