The market will have several developers who all need the same permissions. Granting them to each user one by one is slow, and the copies drift apart. A group is a set of users: whatever is attached to the group applies to every member.

The rule of thumb: grant to groups, and put people in groups. A new developer then needs one command, and someone who changes job leaves one group and joins another. A user can be in several groups and gets the permissions of all of them.

Making a group

aws iam create-group --group-name developers

A new group, like a new user, has no policies.

Adding members

aws iam add-user-to-group --group-name developers --user-name dana

The command prints nothing when it works. Run it once for each user.

Reading a group

aws iam get-group --group-name developers

{
    "Users": [
        { "UserName": "dana", "Arn": "arn:aws:iam::123456789012:user/dana" }
    ],
    "Group": { "GroupName": "developers", "Arn": "arn:aws:iam::123456789012:group/developers" }
}

The answer lists the members under Users. A group is not an identity of its own: nobody signs in as a group, and a group has no keys. It is only a place to attach policies for many users at once.