IAM — Who Can Do What in AWS

IAM (Identity and Access Management) controls who is authenticated (signed in) and authorized (has permissions) in your AWS account.

IAM components:

Users — represents a person or service; has credentials (username/password and/or access keys)

Groups — collection of users; apply policies to the group, not individual users

Roles — temporary identity assumed by AWS services, applications, or federated users; no permanent credentials

Policies — JSON documents defining permissions (Allow/Deny on Actions on Resources)

Root account: Created when you open an AWS account. Has full access. Should NEVER be used for day-to-day tasks. Enable MFA immediately. Create an IAM admin user for daily work.

Principle of least privilege: Grant only the minimum permissions needed to perform a task. Start with no permissions; add only what's needed.

IAM is global — not region-specific. Users and roles exist across all regions.

MFA (Multi-Factor Authentication): Enable for root account and all privileged users. Virtual MFA (Authy, Google Authenticator), hardware key, or SMS.

Reference:

Wikipedia: IAM

https://en.wikipedia.org/wiki/Identity_management