# What is IAM? — AWS

Source: https://www.geekswithgeeks.com/en/aws/aws-iam-basics

> Users, groups, and roles — who is allowed to do what.

## Identity and Access Management

**IAM** controls *who* (a person, an app, another AWS service) can perform *what action* on *which resource* in your account. It's the security backbone of everything else in AWS.

## Users, groups, roles

A **user** is one identity (a person or app) with long-term credentials. A **group** is a set of users sharing permissions. A **role** is a temporary identity anything can assume — no long-term keys.

## Office badges

A user is like an employee's permanent badge. A group is a badge template for a department ('engineering'). A role is a visitor badge issued at the desk — valid only for the visit, then it expires.