What is the difference between an IAM user, a group, a role and a policy?

Users, groups and roles are identities. A policy is the list of permissions you attach to them.

• An IAM user is an identity with long-term credentials, such as a console password or access keys. It belongs to one person or one system.
• A group is a set of users. You attach permissions to the group once, instead of to each user. You cannot sign in as a group.
• A role is an identity with no long-term credentials. A trusted principal (the thing that acts) assumes the role and gets temporary credentials from STS (AWS Security Token Service). The principal can be an EC2 instance, an ECS task, a Lambda function, a user from another account, or a federated SSO user. The role's trust policy controls who may assume it.
• A policy is a JSON document. It lists which actions are allowed or denied on which resources. You attach policies to users, groups and roles, or to resources such as S3 buckets.

Best practice: prefer roles and federation (signing in through an outside identity provider) over users with access keys.