An IAM identity is an AWS user or role that receives permissions through attached policies. It is the security principal that AWS evaluates when a request is made, whether the request comes from the console, an API call, or an automated workload. In practice, the identity defines what the caller can do, such as reading storage, starting instances, or managing other resources.
This matters because a stolen access key does not grant generic AWS access; it grants the permissions of the specific IAM identity it belongs to. Attackers use valid credentials to act normally through AWS APIs, which can make abuse harder to spot than malware. Defenders reduce risk by applying least privilege, preferring roles with temporary credentials over long-lived keys, and monitoring identity activity for unusual actions, privilege changes, or new access patterns.