Every call to a cloud API must be checked against who is asking and what they are allowed to do. IAM policies grant exactly the actions and resources needed, and roles give EC2 or Lambda short-lived credentials so no access keys sit in code. Use a role, not a user with stored keys, whenever a service talks to AWS. Interviewers often ask what happens when an Allow and a Deny both match.