We can also associate an IAM role to a group, and allow the users to access different AWS services based on the role and its associated policies. To attach a role, you can use the role-arn property of the aws cognito-idp admin-list-groups-for-user command.