I would not move authorization into AWS unless you want to spend hours debugging YAML & JSON blobs & templates, struggle with verification, and worse yet, transfer application superuser work onto devs & admins. (Edit: also forgot about core feature lock-in that has to be redone if you switch clouds)

Having a user interface where trusted users can assign privileges to lower-level folks is massively advantageous if you build it right, by comparison. You do need to make fine-grained control possible, to be able to roll up permission sets into predefined roles, and - a simple matter that evades many - assign multiple roles to a given user. Users frequently "wear multiple hats", as they say, and you need to account for that.