- To manage user permissions
- To control access to KMS keys
- To encrypt data at rest
- To monitor API calls