Which AWS service is used for managing access to AWS resources?

AWS Identity and Access Management (IAM) is the service that controls who can access which AWS resources and what actions they can perform. With IAM you create users, groups, and roles, and attach policies that grant permissions to AWS services and resources. Policies are JSON documents that specify allowed or denied actions, resources, and conditions. IAM also supports multi‑factor authentication, password policies, and integration with corporate directories via IAM Identity Center or SAML. Unlike services such as KMS or Secrets Manager, which focus on encryption keys or credential storage, IAM is the central hub for all access control in AWS. It enables fine‑grained, least‑privilege security across the entire account, making it essential for secure cloud operations. For instance, you can grant a Lambda function the permission to read from a specific S3 bucket by attaching an inline policy to the function’s execution role. This approach keeps the principle of least privilege in practice and simplifies audit and compliance.