More detail
IAM is global. It manages identities (users, groups and roles) and the policies that grant them permissions. Everything starts as denied until a policy allows it. IAM controls access to AWS; your app’s own customers are not IAM users.
IAM (Identity and Access Management)
Decides who can do what to which AWS resource.
Think of it as: The building's security office that issues every badge.
What to know for Level 0
- Everything starts denied. A request is allowed only if some policy explicitly allows it and nothing explicitly denies it, so a new role with no policies can do nothing.
- IAM is global: users, roles and policies work in every Region.