IAM secures ephemeral cloud workloads by issuing short-lived credentials, enforcing least privilege, and binding access to verified workload identity-not static secrets.