I would like to create a isolated team in AWS such that they have access to EC2/S3 etc but cannot see the resources created by the master account.
Ideally I would give this team access to all the services in AWS but I don't want them touching the production services that are currently running in the account. The billing all needs to go through the master account but it would be good if it was broken down in to teams/projects for budget requirements.
I also need some uses to be in multiple teams which looking at Organizations is not possible.
+--------+
| Master |
+--------+
|
+------------------------------+
| | |
+---------+ +---------+ +---------+
|Project A| |Project B| |Project C|
+---------- +---------+ +---------+
| | | | |
| +---+ +-+ | |
| | | | |
+------+ +------+ +------+ +------+
|User 1| |User 2| |User 3| |User 4|
+------+ +------+ +------+ +------+