IAM authorization

To understand authorization within IAM, you will have to look at the different components within the service, as follows:

• Users
• Groups
• Roles
• Identity-based policies

Users

Users are simply IAM objects that reflect the unique identity of someone that requires access to your AWS resources, and they are used as a part of the authentication process, as discussed earlier. The user object can have an associated password, which can be used in conjunction with MFA. Permission policies can be assigned to a specific user, authorizing them to gain access to services and resources; however, this is not considered a best practice. Instead, policies should be assigned to groups.

...