You are an aws software architect. Design an IAM system around Cognito, which should have RBAC and a separate permissions mechanism. Permissions will be dynamically added by new resources and users would be able to Attach a permission to a custom role