IAM - Identity and Access Management

IAM can be defined by its ability to manage, control and govern authentication, authorisation and access control mechanism of identities to your resources within your AWS Account.

The main concepts in IAM are:

Users

Groups

Roles

Access Policies

IAM USERS

Users are entities that represent a person or a service/application ( like in the case of Service Accounts)

IAM GROUPS

Groups are collections of users and have policies attached to them. They help organise users (into departments or functions - like developers or admins) and simplify access management at scale because when you need to add or remove policies that change is automatically applied to all users in that group.

IAM ROLES

Roles can be assumed by trusted entities - a user or a service can assume a role to obtain temporary security credentials. 

https://dev.to/aws-builders/aws-iam-identity-and-access-management-cheat-sheetwrap-up-28mo