An IAM user is a named AWS identity that can be granted permissions and, when needed, programmatic credentials such as access keys. It is different from the account root user: an IAM user is meant for everyday access, while the root identity should be reserved for rare, account-level tasks.
IAM users matter because they are often the bridge between people, automation, and cloud resources. If an IAM user is given broad policies like AdministratorAccess, or if its access keys leak, an attacker can make API calls as that identity and change infrastructure, create resources, or access data. Defenders reduce this risk by applying least privilege, avoiding long-lived keys when possible, rotating exposed credentials, and monitoring CloudTrail for unusual API activity, unfamiliar IPs, and changes to IAM settings.