Identity and Access Management
also called IAM
The system of record for principals, credentials and permissions, and the policy engine that decides what each principal may do.
In cloud, IAM is the real security perimeter — network controls limit reachability, but IAM decides what an identity can actually do once it is there, including things reachable via the control plane regardless of network position.
The practices that matter most: workload identity over static keys, so a service assumes a role and receives short-lived credentials rather than holding an access key that will eventually leak; roles rather than direct grants, so permissions are reviewable in one place; permission boundaries so a team that can create roles cannot create one more privileged than its own; and usage-based review, since providers now report which granted permissions have never been exercised, which turns least privilege from an argument into a report.
The failure that shows up in every audit is the long-lived wildcard role created during an incident and never removed.