Best way to allow multiple users access to S3 on a per-organization or per-group basis

>**Note**: If your question is regarding the AWS Amplify Console service, please log it in the
[official AWS Amplify Console forum](https://forums.aws.amazon.com/forum.jspa?forumID=314&start=0)

**Which Category is your question related to?**
Storage and Auth

**Amplify CLI Version**
4.13.4

**What AWS Services are you utilizing?**
Cognito, S3

**Provide additional details e.g. code snippets**
I'm currently building an application with multiple users divided across multiple (and indefinitely many) organizations. Users need to be able to access data related to their organization and none other. I am avoiding Coginto User Groups as they do not seem to be made for indefinetly many groups or organizations.

In my Graphql API this was pretty straight-forward to solve, using dynamic group auth with a custom groupClaim that I populate in a pretoken lambda.

When it comes to S3, however, I haven't quite figured out **how to protect resources but allow all users of one organization to access these shared files**. I have only found documentation on how to do so with static Cognito User Groups or general public/private/protected access on a per-user basis instead of a per-organization basis.

Any help or ideas?