iam

DE//AGENT currently lists 5 resources under iam: 3 tutorials, 1 mcp server, 1 agent. Everything below is derived from the live registry — counts, capabilities, verification state and security posture come from the curated records, never from marketing copy.

Documented learning objectives across these resources:

• Explain storage/compute separation with one managed example per layer — via Hold the cloud data stack mental model — storage, catalog, compute, IAM
• Name the IAM surface each managed service needs before the first query — via Hold the cloud data stack mental model — storage, catalog, compute, IAM
• Map any cloud data stack into one data flow — storage, catalog, compute, serve — via Hold the cloud data stack mental model — storage, catalog, compute, IAM
• Catch the Glue cost leaks before the invoice — oversized workers, reset bookmarks, drifted catalogues — via Production gotchas — surprise bills, region defaults, and IAM overreach
• Keep small files and repeated metadata repairs out of the bill — via Production gotchas — surprise bills, region defaults, and IAM overreach
• Bind agents to least-privilege profiles so IAM overreach and region drift stay impossible — via Production gotchas — surprise bills, region defaults, and IAM overreach
• Map an AWS data platform into a single data flow before judging it — via Run an AWS data architecture review pass
• Check IAM roles for least privilege — via Run an AWS data architecture review pass

1 more objectives live on the individual resource pages.

These resources map to stage: Cloud (5). Follow the four-phase roadmap to place this topic inside a progression instead of learning it in isolation.

Every entry, its shape and its trust state — sorted by the registry's composite score. This table is the honest version of a marketing comparison: no sponsored placements, no unverifiable claims.

How scores are computed: source quality score.

Highest composite score first:

1. AWS MCP Servers (Labs) score 38.5 — advanced
2. Hold the cloud data stack mental model — storage, catalog, compute, IAM score 34.15 — beginner
3. Production gotchas — surprise bills, region defaults, and IAM overreach score 34.15 — intermediate

Scores rank provenance, completeness and trust — read how verification works before adopting anything.

Start here if you're new: Hold the cloud data stack mental model — storage, catalog, compute, IAM.

Reach for these with production experience: AWS MCP Servers (Labs), AWS Architecture Reviewer.

Security-flagged entries: AWS MCP Servers (Labs) (5 flags), AWS Architecture Reviewer (3 flags). Flags mean the record declares capabilities like credential use or write access — read the security posture on each page before connecting.

• AWS MCP Servers (Labs) — A suite of AWS Labs servers — including documentation search, CDK/Terraform assistance, and service-specific servers — for agents working on AWS. details
• Hold the cloud data stack mental model — storage, catalog, compute, IAM — Build the map before opening a console: object storage holds the bytes, a managed catalog describes them, and serverless compute bills for what a query scans. Walk the same shape t… details
• Production gotchas — surprise bills, region defaults, and IAM overreach — The surprises that turn into invoices: workers sized by habit, a renamed prefix that silently resets a bookmark, thousands of small files, an agent holding an admin role, and a que… details
• Run an AWS data architecture review pass — Point the AWS Architecture Reviewer at an architecture description or IaC and follow its four-step workflow: map the services to a data flow, check IAM for least privilege, estimat… details

Real install commands from the registry — read the source before running any of them:

uvx awslabs.core-mcp-server@latest

AWS MCP Servers (Labs) — review first

Adjacent topics: tutorial (3 shared), cost (2 shared), architecture (2 shared).

Study path: the roadmap places this topic in a progression · the scoring model explains the numbers · the trust rule catalog shows every security check these entries passed through.