IAM User vs Group vs Role vs Policy.

In Simple Words:

• User: Permanent identity with credentials for a specific person or service.
• Group: Collection of users that share the same permissions.
• Role: Temporary identity assumed by trusted services (EC2, Lambda) or users via temporary STS tokens.
• Policy: JSON document defining allowed (Allow) or denied (Deny) permissions.

// Least-privilege IAM policy allowing S3 read on a specific folder:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": "arn:aws:s3:::company-reports/public/*"
    }
  ]
}