What is IAM in cloud?
In our series on cloud networking, we’ve covered how data moves (BGP, Anycast) and how networks connect (Peering, VPNs). But there is a final, vital question: Who is allowed to walk through those doors?
IAM (Identity and Access Management) is the "Bouncer of the Cloud." It is the framework of policies and technologies that ensures the right people and the right machines have the right access to the right resources—and absolutely nothing else.
In traditional networking, security was about the "location" (are you in the office?). In the cloud, location doesn't matter. What matters is your Identity.
IAM breaks security down into two simple steps:
Authentication (Who are you?): Confirming you are who you say you are (via passwords, MFA, or biometrics).
Authorization (What can you do?): Once we know it’s you, what are you allowed to touch? Can you just read a file, or can you delete the whole database?
To manage thousands of users, cloud providers (AWS, Azure, Google Cloud) use a specific hierarchy:
Principals (Users & Root): These are the people (employees) or the "Root" account owner.
Groups: Instead of giving permissions to every individual, you create a "Developers" group or a "Finance" group. You give the permissions to the group, and anyone you drop into that group inherits them.
Roles: This is for temporary access. A role isn't a person; it's a "hat" that a user or a service (like a web server) can put on to perform a specific task for a short time.
Policies: The actual "rulebook." These are usually JSON documents that explicitly say: "Allow User X to reboot Server Y on Tuesdays between 9 AM and 5 PM."
If you remember only one thing about IAM, let it be this: Never give a user more power than they need to do their job.
If a junior developer only needs to upload images to a folder, don't give them "Admin" rights. If their account is ever hacked, the hacker is trapped in that one folder. If they have Admin rights, the hacker owns your entire company.
While they all do the same thing, they use slightly different labels:
| Feature | AWS | Azure | Google Cloud (GCP) |
| Primary Tool | IAM | Microsoft Entra ID (formerly Azure AD) | Cloud IAM |
| Identity Unit | IAM User | Service Principal / User | Google Account / Service Account |
| Org Structure | Accounts & OUs | Subscriptions & Resource Groups | Projects & Folders |
| Pricing | Free (for core IAM) | Tiered (Free vs. Premium) | Free (for core IAM) |
Enable MFA Everywhere: Passwords are easy to steal; a physical thumbprint or a rotating code on a phone is much harder.
Ditch the "Root" Account: The account you used to sign up for the cloud has "God Mode" powers. Create a normal Admin user for daily work and lock the Root credentials in a virtual vault.
Use Service Roles for Machines: Never hard-code "Access Keys" into your software. Use IAM Roles so your servers can talk to each other securely without needing a password.
Audit Regularly: People change jobs or leave the company. Use "Access Analyzers" to find and remove "ghost" users who still have keys to the building.
IAM is the most important security layer you will ever configure. It’s the difference between a secure, organized enterprise and a "flat" network where one stolen password can take down the entire business.