OP here. You _can_ do this but IAM Policy wise it is a mess and not very maintainable.

You end up needing to constantly grant and revoke access to individual resources if you went this route. Instead, it's nice to give engineers access to everything that's in their account, and not worry about IAM policies.