without answering any of your questions, if you’re going to deal with a lot of policies be mindful of IAM limits (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html). Some of them are very low. Like, “Managed policies attached to an IAM group: 10”.