The AWS official site reads role as a collection of permissions and group as a collection of users. But still, they look the same to me. You attach policies to groups or roles and then assign groups or roles to a user. What exactly are the differences between role and group?