IAMAccount.template
- Change IAMUser to IAMUsers, with type CommaDelimitedList
- Change ManagedAccount to ManagedAccounts, with type CommaDelimitedList
- Change addUserToGroup to add each user defined in IAMUsers to the Group.
- Change MacGroup PolicyDocument to add one Policy Statement Resource for each Managed Account
If this can not be done in native CFT, then create a Lambda Job to take the IAMUsers, and ManagedAccounts as payload, and return the proper CFT syntax that can be substituted in.