IAM: Users, Roles, Policies

Create least-privilege database users with SQL CREATE USER/GRANT or map them to IAM for short-lived token logins, and never let the application use the all-powerful master user.

User is a permanent person, Group bundles people for shared rules, Role is a temporary borrowed identity, and Policy is the rulebook that grants the actual permissions.

Authentication proves who you are, authorization decides what you may do, and in IAM an explicit deny beats an explicit allow, which beats the default implicit deny.

Grant only the exact actions on the exact resource that the job needs, so a leak or mistake can only harm that one thing.

Use a Role for machines, cross-account, and anything temporary, because it hands out expiring credentials, while an embedded long-lived key is a secret that never expires and never should exist in code.