Identity and Access (IAM Concepts)

Separate people from machines

Identity and access management (IAM) answers two questions: who is calling, and what are they allowed to do? People use users or federated identities; applications often use roles or service accounts so secrets are not baked into code.

Policies grant or deny actions

A policy lists allowed API actions on resources—for example, read an object bucket but not delete it. Attach policies to users, groups, or roles. Prefer roles that apps assume temporarily over long-lived access keys when the platform supports it.

Practice least privilege

• Start with no access, then add only required actions
• Avoid using the root or subscription owner account for daily work
• Enable MFA on human accounts
• Rotate keys and prefer short-lived credentials
• Review unused permissions periodically

Who am I right now?

Confirm the identity your CLI is using before you create or delete resources.

# AWS
aws sts get-caller-identity

# Azure
az ad signed-in-user show --query userPrincipalName -o tsv

# Google Cloud
gcloud auth list