Roles vs Users vs Groups

Summary

A User is a long-lived identity for a person, a Group bundles permissions for multiple users, and a Role is a temporary, assumable identity — often used by services or for cross-account access, without long-lived credentials.

• 1Create an IAM group, add a user to it, and attach a policy to the group instead of the user directly.
• 2Create a role and practice assuming it to perform an action.
• 3Learn why roles are generally preferred over long-lived access keys for service-to-service access.