An IAM identity can be an IAM User, IAM role, or IAM Group.

• IAM User: Represents a user or application interacting with AWS. Users are given long-term credentials like usernames and passwords for the console or access and secret keys for programmatic access. There are actions only the root user can carry out, such as deleting an account.
• IAM Role: Not intended for a unique user; instead, it is assumed by AWS services or external users with common functions. Roles use time-limited security credentials and require choosing a trusted entity upon creation.
• IAM Group: A collection of IAM users. Policies attached to a group are inherited by the users under it. Groups make user management easier, though they cannot be nested.