IAM questions usually reduce to one idea: identities receive permissions through policies, and roles let one identity temporarily assume another set of permissions without long-lived credentials. This tutorial walks through each object type, shows a minimal policy document, and explains the evaluation order that decides whether a request is allowed.