roles are easier to manage once you get going, but users are easier to get going with (understand). also, with users, if you have to rotate access keys you have to update for every user. with roles that can go away