A Config rule that checks whether IAM groups have at least one IAM user.

CloudFormation Template