IAM provides the following basic functions:
You can control user access to different projects and grant different permissions to users for the same project. For example, you can grant some users permissions to manage Object Storage Service (OBS), and grant other users only the permissions to read data from OBS.

You can authorize users in just two steps:
Federated identity authentication enables users in your identity authentication system to access your resources through single sign-on (SSO).
You can delegate your operation permissions to a cloud service or another account so that the cloud service or account can access your resources.
Users can be authenticated by IAM to access other services, for example, Relational Database Service (RDS), Cloud Trace Service (CTS), and OBS, based on assigned permissions.
You can set multi-factor authentication (MFA), login authentication and password policies, and an access control list (ACL) to keep user information and system data secure.