IAM

ELI5 — The Vibe Check

IAM is the permission system for AWS. It controls who (users, roles, services) can do what (read S3, start EC2, invoke Lambda) on which resources. Got locked out of your own AWS account? IAM. Lambda can't access your database? IAM. Security breach from over-permissive roles? Also IAM.

Real Talk

AWS IAM is the access control system for AWS. It manages users, groups, roles, and policies. Policies are JSON documents defining allowed/denied actions on resources. IAM roles allow AWS services to assume permissions without embedding credentials. The principle of least privilege should always be applied.

Show Me The Code

// IAM policy — allow S3 read only on a specific bucket
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["s3:GetObject", "s3:ListBucket"],
    "Resource": [
      "arn:aws:s3:::my-bucket",
      "arn:aws:s3:::my-bucket/*"
    ]
  }]
}

When You'll Hear This

"Give the Lambda an IAM role with S3 write permissions." / "Never use root credentials — create an IAM user with limited permissions."