An identity-based policy is an IAM security measure that defines exactly what specific users, groups or roles can access and do in a cloud environment.