Introduction: Who Are You and What Can You Do?

Identity and Access Management (IAM)

Think of AWS like a large office building with hundreds of rooms, each containing valuable equipment. IAM is the security system for that building — it controls who gets a badge, which doors each badge can open, and what each person can do once they're inside a room. Without it, anyone who walked through the front door could access everything.

In the cloud, the old model of "inside the firewall = trusted" no longer applies. Servers are rented, networks are virtual, and employees access resources from anywhere in the world. Security must be defined by identity — who you are and what you're explicitly permitted to do — not by your physical or network location.

IAM enforces two fundamental concepts:

• Authentication (AuthN): Proving who you are. AWS verifies your identity using credentials — an access key pair for programmatic access, a username/password for the console, or a federated token from an external identity provider like Okta or Active Directory.
• Authorization (AuthZ): Determining what you're allowed to do. After AWS knows who you are, it evaluates policies to decide whether your requested action is permitted.

IAM is the single most critical service in AWS. If you misconfigure EC2, your server crashes. If you misconfigure IAM, your entire company can be compromised. A leaked access key with overly broad permissions has been the root cause of some of the largest cloud security breaches in history. Understanding IAM deeply — not just how to use it, but how it reasons — is the difference between a cloud practitioner and a cloud architect.