An IAM user is a person or service used to interact with AWS. They access the Management Console via a password or multi-factor authentication (for the new user), or they may have an access key for programmatic access using the command-line interface or the SDKs. As shown in the following diagram, you can attach a policy to a user to grant them access to a resource to read DynamoDB within a specific IP range: