TOPIC CLOUD
IAM who can do what on which resource
IN 10 SECONDS
IAM (Identity and Access Management) is the policy engine for cloud platforms. A `principal` (user, role, or service account) attempts an `action` (like `s3:GetObject`) on a `resource` (like `arn:aws:s3:::my-bucket/*`). A policy document — JSON with `Effect: Allow/Deny` — either permits or denies the request.
GOTCHA An explicit `Deny` always wins over any `Allow`. Even if a principal has AdministratorAccess attached, a single Deny statement blocks the action. Use this for guardrails like preventing public S3 buckets.
HOW AN IAM DECISION IS MADE
01 Principal makes an API call with their credentials (access key, OIDC token, or session).
02 Cloud IAM engine collects all applicable policies: identity-based, resource-based, and organization SCPs.
03 Engine evaluates policy statements in order: explicit Deny → explicit Allow → default Deny.
04 Engine caches the decision for the duration of the credentials' TTL to avoid re-evaluating every call.
POKE IT YOURSELF
aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:user/admin --action-names s3:ListBucket — test what actions a policy allows
gcloud iam roles list --project MY_PROJECT — list all custom IAM roles
Drill this topic →
~80 sec read