IAM

AWS Identity and Access Management (IAM) controls authentication (who can sign in) and authorization (what they can do) across AWS services and resources. It uses four constructs: users (individual identities), groups (collections of users sharing permissions), roles (temporary identities assumed by services or federated users), and policies (JSON documents that allow or deny actions). The key exam distinction: users carry long-term credentials, while roles issue short-term, automatically rotated credentials. Roles are the preferred way to grant AWS services like EC2 or Lambda permission to call other APIs — safer than embedding access keys in code.