5.1. Managing IAM

💡 First Principle: IAM's whole design is built around one goal — granting exactly the access needed, at exactly the right scope, without either blocking legitimate work or over-granting access that becomes a liability the moment a credential is compromised.

Getting IAM wrong doesn't fail loudly the way a networking misconfiguration does — an over-permissioned identity works fine every single day until the one day it's compromised or misused, at which point the blast radius is however broad that excess permission was. This is exactly why the exam treats IAM configuration as foundational rather than an afterthought bolted onto other domains.

⚠️ Common Misconception: Granting the primitive Owner or Editor role is an acceptable shortcut for day-to-day access. In reality, primitive roles grant sweeping, project-wide permissions; predefined and custom roles that follow least privilege are the practice the exam expects and real environments require.