What is AWS IAM and why is it important?

IAM (Identity and Access Management) controls **who can do what** in your AWS account.

Key concepts:
- **Users** — individual people with credentials
- **Groups** — collections of users (e.g., Developers, Admins)
- **Roles** — temporary permissions for services or external accounts
- **Policies** — JSON documents defining allowed/denied actions

```json
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject"],
"Resource": "arn:aws:s3:::my-bucket/*"
}
```

**Best practices:**
1. Never use the root account for daily tasks
2. Apply least privilege — give minimum permissions needed
3. Enable MFA for all users
4. Rotate access keys regularly