IAM (Identity and Access Management)
IAM is the discipline of managing digital identities and what they may access — authentication (who you are), authorization (what you may do), and the policies binding them. In AWS it is the JSON policy language controlling every API call.
The AWS flavor
AWS IAM policies are JSON documents: statements with Effect (Allow/Deny), Action, Resource (ARNs), and optional Condition. Principals attach to users, roles, or services. Deny always wins, and permission comes only from an explicit Allow — implicit deny is the default.
The patterns that cause breaches are well known and checkable: wildcard actions (s3:*), wildcard resources, iam:PassRole to powerful roles, privilege-escalation chains (iam:PutRolePolicy, lambda:CreateFunction + PassRole, and friends), NotAction traps, and public principals. Our validator flags all of these, and the two IAM articles catalog the escalation patterns in detail.
IAM as architecture
Good IAM is least privilege made concrete: scoped-down policies, short-lived roles over long-lived keys, conditions on source and principal. It is the operational core of a Zero Trust architecture and the layer where most cloud security actually happens.
Related Terms
Related Standards
- •AWS IAM policy language (JSON)
- •NIST SP 800-207 — Zero Trust context
Free Tools & Resources
Further Reading
Need help with this?
We consult and build across all of these domains — tell us what you are working on.