What does IAM have to do with Cloud Security Posture Management (CSPM) and Compliance?

How you can tell if you need to get a CSPM solution and is it really necessary in order to be compliant in the cloud?