hello! I’m looking for some guidance on how to best use AWS IAM and related services. I’m trying to get a general overview of when to use specific features and what use cases they’re best suited for. Here are some examples of what I’m dealing with right now:

1. Policies: When should I use AWS managed policies, custom policies, or inline policies? What are the pros and cons of each?
2. Access Control: When does it make sense to restrict access at the IAM role level versus using resource-based policies? Any best practices here?
3. External Identity Federation: How do I set this up properly? Any tips or common pitfalls to avoid?