Which IAM resource should the company use to meet this requirement with the LEAST operational overhead?

Explanations:

IAM user groups can help manage permissions for a set of users but do not offer the flexibility needed for frequent team changes, as they tie permissions to static groups rather than dynamic roles.

IAM roles are designed for temporary permissions and can be easily assumed by users when they change teams. This minimizes operational overhead as roles can be reused across teams without modifying individual user permissions directly.

IAM instance profiles are specifically used to provide permissions to EC2 instances rather than managing user permissions across teams, making them unsuitable for this requirement.

IAM policies for individual users can become cumbersome to manage as the number of users increases and permissions change frequently. This approach results in higher operational overhead compared to using roles.