Answer
An IAM user represents a specific person or application with its own long term credentials, an IAM group is a collection of users that share the same set of permissions, making it easier to manage permissions for many users at once, and an IAM role is an identity with specific permissions that can be temporarily assumed by a user, application, or AWS service, without requiring any long term credentials, making roles the generally preferred approach for granting temporary, well scoped access.
aws iam create-role --role-name EC2S3AccessRole --assume-role-policy-document file://trust-policy.jsonReal-world example A company organizes its developers into an IAM group with shared development permissions, while separately creating an IAM role that its EC2 instances assume to gain temporary permission to access a specific S3 bucket, without ever needing permanent credentials stored on the instance itself.