title: what can you do with IAM roles that you cannot do with IAM groups?
body: <p>I have read the documentation about IAM roles and IAM groups but I am missing something simple: I don't understand what you can do with IAM roles that you cannot do with IAM groups.</p>
  <p>In other words, considering these alternatives:</p>
  <ul>
  <li>Using IAM groups, I grant a group permissions to perform certain actions, and then when I want a user to be able to perform those actions, I grant them membership in that group</li>
  <li>Using IAM roles, I grant a role permissions to perform certain actions, and then when I want a user to be able to perform those actions, I grant them permission to assume that role</li>
  </ul>
  <p>What specifically is it that you can achieve with the second method, that you cannot achieve with the first method?</p>