IAM policy is defined to give access to user and manage access control. users are added to groups and policy states for e.g which group can access what.