What is IAM, and what is the difference between users, roles and policies?

IAM controls who can do what in an AWS account.

• Users — long-lived identities for a person or application, with a password or access keys. These should be minimised. Long-lived access keys are the most common cause of AWS credential compromise, usually through being committed to a repository.
• Groups — collections of users for attaching policies. Manage permissions here rather than per user.
• Roles — identities that are assumed temporarily rather than logged into. They have no permanent credentials; assuming one issues short-lived credentials from STS. This is the mechanism AWS wants you to use everywhere: EC2 instances, Lambda functions, and ECS tasks all get roles, and humans federate into roles from an identity provider.
• Policies — JSON documents defining permissions with Effect, Action, Resource, and optional Condition. Identity-based policies attach to users, groups, and roles; resource-based policies attach to resources such as an S3 bucket and specify who may access them.

How evaluation works: an explicit Deny always wins. Otherwise, access requires an explicit Allow, since the default is deny.

Note: Two useful extras. Conditions are where fine-grained control lives — restricting by source IP, requiring MFA, or requiring encryption in transit. And Service Control Policies at the Organizations level set a maximum permission boundary an account cannot exceed, regardless of its own IAM policies.