IAM (Identity and Access Management) controls who can access AWS resources. It manages users, groups, roles, and policies. Follow the principle of least privilege — give only the permissions needed.