AWS, Azure & GCP · Cloud across providers
How does cloud IAM work?
Short answer
Cloud IAM authenticates a principal and authorises actions through policies that bind permissions to resources. Requests are evaluated against identity and resource policies, with explicit deny usually winning.
IAM has four moving parts: the principal making the request, the action being attempted, the resource it targets, and the conditions around the request. A policy statement combines those into an allow or deny decision.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::reports-bucket/*"
}
]
}How requests are evaluated
- Authenticate the principal, then gather identity policies, resource policies and boundary policies
- An explicit deny anywhere overrides any allow
- An allow must exist for the action on the resource; otherwise the default is deny
- Conditions can restrict by source IP, MFA, time, VPC endpoint or resource tags
- Roles and federation provide temporary credentials, which are safer than long-lived access keys
Prefer roles over users for workloads. A compute instance, container or CI job should assume a role and receive short-lived credentials. Human access should go through federation with MFA and group-based assignments.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1What is the difference between an IAM user and an IAM role?
- 2How does an explicit deny interact with an allow?
- 3What are permission boundaries used for?
- 4How would you give a CI job access without storing keys?
Say it in the interview
IAM authenticates a principal and then evaluates policies that bind actions to resources. It considers identity policies, resource policies and boundaries, and an explicit deny wins over any allow. I prefer roles and federation so workloads get short-lived credentials instead of long-lived keys. I also use conditions and narrow resource ARNs to limit blast radius.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live AWS, Azure & GCP mock interview and get scored feedback on depth, clarity and confidence.