The group roles the identity inherits from, typically one of the per-domain
*_read_write / *_read_only groups (rds_iam is added for an IAM login and
never listed). With none it holds only what a migration grants it by name,
which is as easy to get by forgetting the group, so an empty list must say so.
The group roles the identity inherits from, typically one of the per-domain
*_read_write/*_read_onlygroups (rds_iamis added for an IAM login and never listed). With none it holds only what a migration grants it by name, which is as easy to get by forgetting the group, so an empty list must say so.