Loading...
Who can do what in your cloud. The control plane for both security and spend.
Quick Definition
Identity and Access Management (IAM) controls who can access cloud resources and what actions they can perform. Through users, roles, and policies, IAM enforces least-privilege access, forming a cornerstone of cloud security and a key element of zero-trust architectures.
Identity and Access Management, or IAM, is the cloud system that defines identities, people, applications, services, and what each is allowed to do. Every action in the cloud, from launching a server to reading a file, passes through an IAM permission check first.
IAM is usually discussed as security, but it is also a cost control. The permission to create resources is the permission to spend money. Overly broad rights let anyone launch anything anywhere, which is how surprise GPU clusters and forgotten test environments are born. The guiding principle is least privilege: grant the minimum needed, scoped by role, and expand deliberately.
Example. A company restricts production resource creation to its deployment pipeline's identity. Engineers retain full rights in sandboxes with budget caps. Accidental production spend drops to nearly zero without slowing anyone down.
Permissions are defined in JSON policy documents and reviewed like code in mature teams. The cloud security overview explains how identity, governance, and cost intersect.
Granting each identity only the permissions its job requires. It limits both security blast radius and accidental spending power.
Resource creation rights are spending rights. Scoping who can create what, and where, is one of the strongest cost guardrails available.
Sparingly. Most changes should flow through pipelines, with human access granted just-in-time for incidents and audited afterwards.