A company is migrating applications to AWS and wants to ensure each application is granted only the minimum permissions required. Which AWS service provides this capability?

AWS Identity and Access Management (IAM) is the correct service because it allows you to securely control access to AWS resources. With IAM, you can define granular permissions for users, groups, and roles, ensuring that each application or entity only has the minimum necessary access to perform its tasks, aligning with the principle of least privilege. Amazon CloudWatch is a monitoring and observability service, not for managing permissions. Amazon Macie is a data security and privacy service that uses machine learning to discover, classify, and protect sensitive data. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior. Neither Macie nor GuardDuty are used for defining access permissions.