Difference between IAM role and IAM user in AWS

Question

I think an IAM role is used for federated logins (using an IdP with SAML tokens for example), and they don't have permanent access keys that you can download like regular IAM users have (the "an IAM role doesn't have any credentials" part).

What do they mean when they say an IAM role can't make direct requests to AWS services? I can log in to AWS Console (the web console) and create stacks etc, so it can't be that.