Principals, roles, bindings, and policies

Speaker notes

• Principal is the who (a human, group, service account, or federated identity); permission is a single fine-grained capability that's never granted alone; role is a named bundle of permissions; binding connects a role to a principal at a resource; policy is the full set of bindings on one resource.
• Walk the chain explicitly: a permission only ever reaches a principal bundled inside a role, and a role only ever reaches a resource through an explicit binding — skipping a link in this chain is a common source of IAM confusion.
• This vocabulary is precise and load-bearing for the rest of the chapter — every subsequent IAM concept (conditions, service accounts, federation) is a variation on binding a role to a principal at a resource.

Deck map