If the cloud is a building, IAM is the receptionist and security guard. It decides WHO you are (Authentication) and WHAT you can do (Authorization).
Permanent credentials. Like a Physical Badge. Used for actual humans (employees, developers). Should represent one person.
Temporary credentials. Like a Visitor Hat. You put it on to do a specific job (e.g., "Admin Hat" or "Server Hat"), then take it off.
The rules. A JSON Document attached to a User or Role that explicitly says "Allow Access to Bucket X" or "Deny Access to Database Y".
Mission: The User needs to Read the data, but MUST NOT be allowed to Delete it. Configure the JSON Policy correctly.
Only grant the exact permissions needed. Never give AdministratorAccess to a developer who just needs to upload a file.
Lock away the "Root" account credentials in a safe. Create an IAM User for daily work. Root can do anything and cannot be restricted.
Require a code from a phone app for console logins. It stops hackers even if they steal your password.