What Is AWS IAM? Identity and Access Management

AWS IAM (Identity and Access Management) is the service that decides who or what can call which AWS API. Every AWS action is allowed or denied by IAM.

IAM is the front door to your AWS account. It defines principals (users, roles, and services), the policies that grant or deny permissions, and the rules for how they authenticate. Understanding IAM is essential because a pipeline cannot deploy anything to AWS until IAM lets it.

The core IAM building blocks

Users - long-lived identities for people, with keys or passwords.
Roles - assumable identities with temporary credentials, ideal for workloads.
Policies - JSON documents listing allowed and denied actions.
Groups - collections of users that share policies.

Policies and permissions

A policy attaches to a principal and lists actions (like s3:PutObject) on resources (like a specific bucket), with optional conditions. IAM is deny-by-default: nothing is allowed unless a policy grants it, and an explicit deny always wins.

Least privilege

The guiding principle is least privilege: grant only the permissions a principal actually needs. Over-broad policies are a common security risk, so deploy roles should be scoped to the exact resources and actions the pipeline touches.

Temporary credentials

Roles issue short-lived credentials via STS rather than permanent keys. This is safer because credentials expire automatically and never need to be stored, which is exactly what you want for automated pipelines.

Role in CI/CD

A pipeline assumes an IAM role to gain temporary credentials, then deploys. The modern pattern is OIDC: GitHub Actions presents a signed token, IAM trusts it, and hands back temporary credentials scoped to a deploy role. This removes long-lived AWS keys from your secrets entirely.

Key takeaways

IAM gates every AWS action via users, roles, and policies.
IAM is deny-by-default; least privilege keeps deploy roles tightly scoped.
Pipelines should assume roles for temporary credentials, ideally through OIDC.