Before we introduce this recipe, we need to talk briefly about IAM. It's free, and is enabled on every account. It allows you to create groups and users, and allows you to control exactly what they can and can't do, through the use of a policy statement.
By default, groups, users and roles will have no permissions until you assign them either an AWS Managed Policy or a Customer-Managed Policy (one which you manage). You may want to use AWS Managed Policies as a starting point in order to avoid having to create and maintain your own, but it's good practice to refine your requirements, and scope down access privileges with custom policies.
There's a third kind of policy, called an Inline Policy. Use this sparingly. In fact, the only time we typically see it is in CloudFormation templates.
You pretty much never want to assign a policy...
