I second that. It's honestly simple. You assign roles (bundling of individual API call permissions) to cloud identities to resources.