title: Difference between AWS IAM "Identity" and "Entity"
body: <p>I am reading through the AWS documentation <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/intro-structure.html#intro-structure-terms" rel="noreferrer">Understanding how IAM works</a> and I'm confused about the definitions for <em>identities</em> and <em>entities</em>.</p>
  <blockquote>
  <p><strong>Identities</strong><br />
  The IAM resource objects that are used to identify and group. You can attach a policy to an IAM identity. These include users, groups, and roles.</p>
  </blockquote>
  <blockquote>
  <p><strong>Entities</strong><br />
  The IAM resource objects that AWS uses for authentication. These include IAM users, federated users, and assumed IAM roles.</p>
  </blockquote>
  <p>What's the difference between the two? They are both IAM resource objects. They both include users and roles (although only identities have groups). You can only attach a policy to an identity but not an entity, but you ultimately authenticate an entity but not an identity. Is the naming difference just a question of grammar, or is there something fundamentally different between the two?</p>