The last part of your question looks more like business rules for the management of users.
A complex scheme such as AWS IAM policies increases the chance of definition errors.
The business rules don't seem like they would change much over time so coding them in your user management module might be a good compromise.