IAM Roles

Cloud IAM roles are collections of permissions that can be assigned to cloud identities (users, groups, service accounts, or workloads) to control what actions they may perform on cloud resources. Unlike long-lived credentials, role-based access in cloud environments uses temporary credentials assumed via role assumption, eliminating static secret management.

Least-privilege role design — granting only the specific permissions needed — is the primary defense against privilege escalation in cloud environments.