An IAM identity can be an IAM user, an IAM role, or an IAM group:

• IAM User: Represents a person or application interacting with AWS. Users receive long-term credentials, such as a username and password for console access or an access key and secret key for CLI/API programmatic access.
• IAM Role: Not intended for a unique user. Instead, it is assumed by AWS services, IAM users, or federated external users (such as Active Directory, Google, or SAML 2.0/OIDC providers). Roles rely on time-limited security credentials, and a configured trusted entity defines who can assume the role.
• IAM Group: A collection of IAM users used to simplify permission management. Any policy attached to a group is automatically inherited by its member users. An IAM user can belong to multiple groups, but groups cannot be nested within other groups.