IAM Fundamentals
Manage identities and access.
IAM Fundamentals is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What Is IAM?
Identity and Access Management (IAM) is the discipline of ensuring the right identities have the right access to the right resources at the right time.
It is the backbone of organizational security.
Identification vs Authentication vs Authorization
Three distinct concepts:
- Identification: claiming who you are (a username).
- Authentication: proving it (a password or key).
- Authorization: deciding what you may do.
Identities and Principals
An identity represents an entity: a human user, a service account, or a machine.
In access systems, an authenticated identity acting on a resource is often called a principal.
The Identity Lifecycle
Identities move through a lifecycle:
- Joiner: provisioned when someone arrives.
- Mover: access updated when roles change.
- Leaver: deprovisioned when they depart.
Failing to deprovision leaves dangerous orphaned accounts.
Authentication in IAM
IAM centralizes authentication so users prove identity once against a trusted identity provider (IdP).
This avoids scattered, inconsistent password systems across apps.
Authorization Models
Once authenticated, authorization determines permissions.
Common models include RBAC (role-based) and ABAC (attribute-based), covered next lesson.
Accounting and Auditing
The third A in AAA (Authentication, Authorization, Accounting) is logging who did what.
Audit logs support investigations, compliance, and detecting misuse.
Privileged Access
Admin and root accounts are high-value targets. Privileged Access Management (PAM) adds extra controls:
- Just-in-time elevation
- Session recording
- Credential vaulting
Service and Machine Identities
Not all identities are human. Service accounts, API clients, and workloads also need identity.
These often outnumber humans and require careful credential rotation and scoping.
Directory Services
A directory stores identities and groups centrally. Examples include LDAP-based directories and cloud directories.
Applications query the directory rather than maintaining their own user list.
ldapsearch -x -b 'dc=example,dc=com' '(uid=alice)'Why IAM Matters
Most breaches involve stolen or misused credentials. Strong IAM:
- Reduces the attack surface.
- Enforces consistent policy.
- Makes access auditable and revocable.
Quick Check
What is the difference between authentication and authorization?
Recap
You learned the fundamentals of IAM.
- Distinguish identification, authentication, and authorization.
- Manage the joiner-mover-leaver lifecycle.
- Protect privileged and machine identities, and keep audit logs.
Next, we compare the RBAC and ABAC access control models.
Frequently asked questions
Is the “IAM Fundamentals” lesson free?
Yes — the full text of “IAM Fundamentals” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “IAM Fundamentals”?
Manage identities and access. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “IAM Fundamentals” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- IAM Fundamentals
- RBAC and ABAC
- SSO and Federation
- Least Privilege