Do I need IAM and audit logs for a production app?

Usually yes — for a production app, you generally want both IAM and audit logs, though how much you need depends on what the app does and what data it handles.

IAM (Identity and Access Management)

You need IAM if:

• multiple people/services access your app or infrastructure
• you want least-privilege access
• you need to control who can deploy, read data, modify configs, etc.
• you have regulated or sensitive data

In practice, production systems should almost always have:

• separate roles for dev, ops, admins, and services
• service accounts / workload identities
• MFA for human admins
• minimal permissions by default

Audit logs

You need audit logs if you care about:

• security investigations
• compliance requirements
• tracking who changed what and when
• debugging production incidents
• detecting unauthorized access or configuration changes

Audit logs are especially important if your app:

• handles customer data
• has administrative functions
• supports financial, health, or other regulated workflows
• runs in an enterprise environment

Rule of thumb

• Small internal app with no sensitive data: basic IAM and limited logs may be enough.
• Any public-facing production app: strong IAM is strongly recommended.
• Any app with sensitive/regulated data: both IAM and audit logs are effectively necessary.

Practical minimum for production

• Role-based access control
• Least-privilege permissions
• MFA for humans
• Separate environments/accounts/projects
• Centralized logs
• Audit trail for admin actions and security-relevant events
• Log retention and access controls

If you want, I can also give you a production checklist for IAM and audit logging, or tailor the answer to a specific platform like AWS, Azure, GCP, Kubernetes, or Firebase.