Outcome
By the end of this lesson, you will be able to explain how cloud permissions work in plain terms, and say why they matter for cost as well as security.
| Prerequisites | L2 |
| Time | 7 minutes |
1. Concept
In an office, not everyone has a key to every room, and not everyone can sign a purchase order. The cloud has the same idea. It is called identity and access management, usually shortened to IAM.
Three questions IAM answers
- Who are you? Every person, and every program, that uses the cloud has an identity: a user, a group, or a special identity for software (AWS and Google Cloud call some of these roles and service accounts).
- What may you do? Permissions say which actions are allowed: look at resources, create them, change them, delete them.
- Where? Permissions apply to a scope: one account, one project, one subscription, or even one resource group.
AWS and Google Cloud both call their system IAM. Azure calls it Azure role-based access control (Azure RBAC), built on the users in Microsoft Entra ID. The words differ, the three questions do not.
Bundles of permissions
Nobody hands out permissions one by one. They are grouped into bundles. Google Cloud and Azure call these bundles roles, such as “viewer” (can look, cannot change), “contributor” or “editor” (can create and change) and “owner” or “administrator” (can do everything, including giving others access). AWS calls its bundles policies. In AWS, a “role” is something else: an identity that people or software can take on, as in question 1 above. Same idea, different words.
Least privilege
The good practice is called least privilege: give each person only the access they need for their job, and no more. A finance analyst who reads the bill needs a viewer role, not the power to create machines.
Why this matters for cost
In the cloud, creating a resource is spending money. There is no purchase order and no sign-off. Anyone with permission to create a machine can start a cost that runs every hour until someone stops it.
That is very useful: engineers can move quickly. It also means:
- Broad “create anything, anywhere” access lets cost appear in places nobody is watching.
- Limiting expensive actions (very large machines, costly regions) to a few people keeps surprises down.
- Sandbox accounts or projects for experiments, with limits and alerts, let people try things safely.
Providers also offer budgets and alerts: you set an amount for an account or project, and the provider emails you when spending gets close to it. A budget alert usually just warns you; it does not stop the spending by itself.
2. Worked example
A company gives every engineer “owner” access to the shared production account, to save time.
One Friday, an engineer creates five very large machines to test something, at an illustrative $3 per hour each. The test ends on Friday evening, but the machines are left on.
| Period | Hours | Machines | Illustrative rate | Cost |
|---|---|---|---|---|
| Friday evening to Monday morning | 60 | 5 | $3.00 per hour | $900 |
Nobody noticed, because nothing broke. Two changes would have helped:
- A sandbox project for tests, separate from production, where large machines are allowed but a budget alert fires at, say, $200.
- Viewer access by default in production, with create rights limited to the few people who deploy there.
Neither change slows the engineer down. Both make the cost visible and owned.
3. Hands-on (5 min: no account needed)
1. Open the Google Cloud page "Basic roles" (search "Google Cloud IAM basic roles").2. Read what the Viewer, Editor and Owner roles can do.3. Open the AWS page "Creating a budget" in the AWS Billing and Cost Management docs.4. For a team you know, decide which role each person needs: viewer, editor or owner.5. Write one budget you would set, and who should get the alert.If most people on your list only need to look, you have just applied least privilege.
4. Knowledge check
Q1
What does IAM stand for?
A. Internet access monitoring
B. Identity and access management
C. Instant account migration
D. Infrastructure asset manager
Show answer
Correct: B. Identity and access management controls who can do what, and where. Azure’s equivalent is called Azure role-based access control (Azure RBAC).
Q2
What does “least privilege” mean?
A. Give each person only the access their job needs
B. Give everyone owner access to avoid delays
C. Give access only to the most senior people
D. Remove all access outside working hours
Show answer
Correct: A. Least privilege means just enough access for the job. B is the opposite. C and D are blunt rules that do not match access to need.
Q3
Why do permissions matter for cost?
A. Providers charge a monthly fee for every user account
B. Viewer roles cost more than owner roles
C. Anyone who can create resources can start spending money
D. Permissions change the price of each machine
Show answer
Correct: C. In the cloud, creating a resource starts a meter. There is no purchase order, so who can create what is effectively who can spend what.
5. Apply
Ask your cloud team two questions. How many people can create resources in production? And is there a budget alert on each account or project, and who receives it? The answers tell you how easily cost can appear without anyone noticing.