How to setup multi-tenant backend with AWS Amplify?

How can I set up a multi-tenant backend with Amplify that supports both tenants (customers) and user roles (admin, normal user, etc.) within each tenant? I have explored the use of Cognito User Groups, but it only gets me one of the two. Namely, I can get multi-tenancy by customer, but not customer and user roles. Or, user role, but not user role and customer. As far as I understand, this is due to @auth rules being logically OR-red.

Ultimately, I am looking for a solution like this, but I am not sure how to realize it with Amplify.

Any help is much appreciated!