IAM Roles vs Users vs Groups

Users are long-lived identities with credentials. Groups attach policies to sets of users. Roles are short-lived, assumable identities — the right primitive for services, EC2, Lambda, cross-account access.

Rule of thumb

If a human logs in occasionally — User in a Group. If a machine or service needs credentials — Role.

Assume-role trust example

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Service": "lambda.amazonaws.com"},
    "Action": "sts:AssumeRole"
  }]
}