Lesson 4 / 26

What is IAM?

Users, groups, and roles — who is allowed to do what.

Identity and Access Management

IAM controls who (a person, an app, another AWS service) can perform what action on which resource in your account. It's the security backbone of everything else in AWS.

Users, groups, roles

A user is one identity (a person or app) with long-term credentials. A group is a set of users sharing permissions. A role is a temporary identity anything can assume — no long-term keys.

Office badges

A user is like an employee's permanent badge. A group is a badge template for a department ('engineering'). A role is a visitor badge issued at the desk — valid only for the visit, then it expires.