Employees frequently move between teams and need permissions that match their job responsibilities. Which IAM construct should the company use to provide appropriate permissions with the least operational overhead?

IAM roles are the best choice because they provide temporary permissions that can be assumed by users, applications, or services. When an employee moves teams, they simply assume a different role, granting them the necessary permissions without modifying their individual user settings. This significantly reduces operational overhead compared to managing permissions directly on individual users. IAM user groups are useful for assigning permissions to a collection of users, but if users frequently change teams, you'd still need to move users between groups, which can be cumbersome. IAM instance profiles are specifically for EC2 instances to assume roles, not for human users. IAM policies for individual users would require manual updates for each user every time their responsibilities change, leading to high operational overhead and potential for errors.