Set up an AWS Organizations hierarchy, and replace the FullAWSAccess policy with the following Service Control Policy for the governed organization units:

Create multiple IAM users for the regulated accounts, and attach the following policy statement to restrict services as required:

Set up an Organizations hierarchy, replace the global FullAWSAccess with the following Service Control Policy at the top level:

Set up all users in the Active Directory for federated access to all accounts in the company. Associate Active Directory groups with IAM groups, and attach the following policy statement to restrict services as required: