IAM users, groups and roles

An IAM user is an identity for one person or application, with its own name and credentials (a console password and/or access keys). An IAM group is a collection of users, used to manage permissions for many users at once: policies attached to the group apply to every member. A user can belong to several groups, and permissions from all groups combine, but a group cannot contain another group and a group cannot sign in.

An IAM role is an identity with permissions that is assumed temporarily by users, applications or AWS services. Assuming a role returns temporary credentials issued by the AWS Security Token Service (STS), so no long-term keys are stored. A role has two kinds of policy: a permissions policy (what it can do) and a trust policy (who may assume it).

The root user has complete access to the account, so protect it with MFA and use it only for the few tasks that require it.

Exam trap: for an application on an EC2 instance, use a role, not access keys stored in the code.