Identity and Access Management

Identity and Access Management (IAM) controls who can access which cloud resources and what actions they're permitted to perform, forming the backbone of cloud security.

Users, Roles, and Policies

IAM systems typically separate identities (users or applications) from permissions (what they're allowed to do), connected through policies. A "role" is a set of permissions that can be assumed temporarily, useful for granting an application or service exactly the access it needs without permanent, standing credentials.

The Principle of Least Privilege

Every identity — human or automated — should have exactly the permissions it needs to do its job, and nothing more. This limits the potential damage if a set of credentials is ever compromised, since an attacker would only gain the narrow access that specific identity was granted.

Common Mistakes

• Granting broad "administrator" access to users or applications that only need a small, specific set of permissions.
• Using long-lived, permanent credentials for automated processes when a temporary, role-based approach would be more secure.
• Sharing a single set of credentials across multiple people instead of giving each person their own individually tracked identity.
• Not enabling multi-factor authentication (MFA) on privileged accounts, leaving them vulnerable to compromised passwords alone.