IAM roles, groups, users, and policies
Controlling access to your resources in IAM comes down to how you craft your policies that you attach to your users, groups, and roles. Services themselves assume roles, and users are created in IAM and are much more easily managed if placed into groups.
Note
There is a service limit of 500 IAM users per account.
IAM policies
An IAM policy is a set of permissions expressed as a JSON statement that says which access permissions an entity has.
As you start to dole out the permissions in your account, you will deal with these IAM policies. There are a number of policies that have been pre-crafted by AWS to help you get started, either to attach to users and groups or for services. Many AWS-based policies will have the resource listed as *; however, this allows for any resource to be accessed. There are multiple ways in which we can constrain the amount of resources that can be accessed, even in the case of a simple policy.