Primitive
IAM
Governs who (users, services) may perform which actions on which resources, via authentication and authorization policies.
Description
Identity differs conceptually more than it appears. AWS IAM and GCP IAM are primarily resource-access control planes that attach policies/roles to principals, whereas Azure splits the directory (Microsoft Entra ID, formerly Azure AD) from resource role assignments (Azure RBAC). They differ in their policy languages, how roles and permission boundaries are expressed, and how workload/service identities and federation are handled. To the best of our knowledge all provide authentication, fine-grained authorisation, and auditing, but policies are not portable between them — model access in each provider's own terms.
Capabilities
- Authenticate users and services
- Authorize actions with fine-grained policies
- Issue and rotate credentials
- Audit access decisions