So after reading through this: AWS IAM Role vs Group I'm not entirely sure what would be better for a group of users.
We're looking at implementing a group of users with least privileges, but doing it by giving them all a 'dev' role to assume, rather than a group.
This seems reasonable but what's the best practice here? What advantages do AWS User Groups have over Roles or vice versa?
IAM groups and roles, they both serve different purpose.
An IAM group is primarily a management convenience to manage the same set of permissions for a set of IAM users. Groups can be granted permissions using access control policies. This makes it easier to manage permissions for a collection of users, rather than having to manage permissions for each individual user.
IAM roles allow you to delegate access with defined permissions to trusted entities without having to share long-term access keys. You can use IAM roles to delegate access to IAM users managed within your account, to IAM users under a different AWS account, or to an AWS service such as EC2.
Please check out AWS IAM Faqs for more details.
