AWS serverless multitenant architecture

We require a multi tenancy environment using Cognito with least privilege access with role based control using IAM roles & policies, within a VPC environment in AWS.