You should checkout BLESS (or better, Lyft's changes to BLESS), which drastically reduce the work traditionally needed to do this. Basically, you piggy-back on

You should checkout BLESS (or better, Lyft's changes to BLESS), which drastically reduce the work traditionally needed to do this. Basically, you piggy-back on your cloud provider's security tooling.