In one sentence
A user is an identity, a group organizes users, a policy describes permissions, and a role is an assumable identity that provides temporary permissions.
Comparison
| Object | Meaning | Main use |
|---|---|---|
| Root User | The account’s inherent identity | Recovery and root-only tasks |
| IAM User | A long-term identity inside one account | Limited legacy or compatibility cases |
| IAM Group | A permission-management collection of IAM users | Shared job-role permissions |
| IAM Policy | A JSON permissions document | Effect, Action, Resource, and Condition |
| IAM Role | An assumable permissions identity | Workloads, cross-account access, temporary access |
| IAM Identity Center | Workforce access across accounts | SSO and permission sets |
Exam rules
Groups contain users only, cannot contain groups, cannot sign in, and cannot be assumed. A user may belong to multiple groups and inherits all applicable group policies. An applicable explicit Deny still overrides Allow.
Managed policies can attach to users, groups, or roles. Inline policies can be embedded in one user, group, or role. Policies are not identities, and identity-based policies do not contain Principal.
Scenario choices
Use a group for shared user permissions, a role for EC2-to-S3 access, IAM Identity Center for workforce multi-account access, Cognito for application customers, and root only for required root tasks.
The three essential parts of a role
| Part | Purpose |
|---|---|
| Trusted entity / trust policy | Defines who can assume the role |
| Permissions policy | Defines which actions and resources the role session may use |
| STS temporary credentials | Supplies an expiring access key ID, secret access key, and session token |
EC2 uses a role through an instance profile, so creating the role alone is not enough—it must be associated with the instance. An operator passing a role to EC2, Lambda, or another service normally needs iam:PassRole. PassRole means “give the role to a service”; AssumeRole means “the principal uses the role.”