This is really similar to what Amazon uses in-house to manage aws roles. Not sure if there’s a commercial or open-source alternative but this could be a fruitful project for someone!