Yes, you can use AWS Organizations to set up a policy-based governance framework that allows you to set rules and policies that apply to all of the AWS accounts in your organization. This allows you to control which services and actions your InfraAdmin role can use, as well as restrict the policies and roles it can create.
To do this, you would first need to create an organizational unit (OU) for your InfraAdmin role, and then attach a service control policy (SCP) to that OU that specifies the services and actions that the InfraAdmin role is allowed to use. You can then use AWS Identity and Access Management (IAM) to define the policies and roles that the InfraAdmin role is allowed to create, and attach those policies to the InfraAdmin role.
For example, you could create an SCP that allows the InfraAdmin role to use only the EC2, RDS, and S3 services, and restrict the actions that it can perform on those services to only the ones that are necessary for creating and managing the bundles you described. You could then use IAM to create policies that allow the InfraAdmin role to create and manage instance profiles, roles, and policies for those services, and attach those policies to the InfraAdmin role. This would allow the InfraAdmin role to create the necessary resources for the bundles without giving it the ability to grant extra rights to itself or create new more powerful roles.
Overall, using AWS Organizations and IAM in this way allows you to set up a more fine-grained and secure access control system for your AWS accounts and resources.
