Security & Compliance
Identity & Access Management
The system for controlling who can access what in your cloud account, granting each user and service only the permissions it needs.
IAM governs who, and what, can do which actions in your cloud account. It's how you give a teammate permission to restart servers but not delete databases, or hand a deployment script a narrowly scoped key instead of the master credentials. The guiding principle is least privilege: every user and every service gets exactly the access it needs and nothing more.
This matters because a single over-permissioned credential is how small breaches become catastrophic ones. A leaked API key that can only read one bucket is an incident. One with full account access is a disaster. The hyperscalers have deep, sometimes bewildering IAM systems, while simpler hosts offer basic team roles and scoped API tokens that cover the same idea with less ceremony.
The habits that pay off are mundane and rarely followed: scope keys tightly, rotate them, remove access when people leave, and never share one root credential across a team. IAM is unglamorous plumbing, and it's where a large share of real-world cloud breaches trace back to.
Go deeper
- Cloud Hosting Security: What's Your Job vs the Provider'sThe shared responsibility model, and the specific things people forget to configure.