The last part of your question looks more like business rules for the management of users.<p>A complex scheme such as AWS IAM policies increases the chance of definition errors.<p>The business rules don&#x27;t seem like they would change much over time so coding them in your user management module might be a good compromise.