When to use an IAM role, IAM group & IAM user.
Whenever an AWS service needs access to other AWS services/resources then the IAM role comes into play.
To grant access to IAM user of respective service or group of services IAM policies are assigned and to give access to a group of users (e.g. All users of say backup team needs access to S3 bucket & glacier) an IAM group is created say - “Backup_team” to which all the user’s are assigned and respective policy is added.