IAM

AWS Identity and Access Management (IAM) controls authentication and authorization across all AWS services, including AI services like Amazon Bedrock, SageMaker, and Rekognition. IAM users, groups, and roles get permissions through JSON policies specifying which actions are allowed or denied on which resources. The key exam nuance is identity-based policies (attached to a principal such as a role) versus resource-based policies (attached to the resource itself). SageMaker training jobs and Bedrock agents assume an IAM execution role at runtime, so misconfigured role trust relationships are a common source of access-denied errors. Apply least privilege.