aws iam create-group --group-name <group_name>
aws iam attach-group-policy --group-name <group_name> --policy-arn <policy_arn>
aws iam add-user-to-group --user-name <user_name> --group-name <group_name>
aws iam detach-user-policy --user-name <user_name> --policy-arn <policy_arn>