Deploy errors using the IAM Group

## Background

Deployments by AWS users in the IAM Group do not appear to be working.

Detailed below are the setup steps I went through while debugging this.

Am I missing something?

## Steps to Reproduce

I downloaded the IAM Group Terraform file from the [setup documentation] locally and replaced the `account` and `prefix` variable values then created the IAM Group with Terraform. I then created a new deploy user, added it to the group, and ran `./manage.py deploy`.

The first deployment returned two "…not authorized to perform kms:TagResource" errors. I saw the comment about adding the generated KMS keys to the IAM Group Terraform file but it seemed a little strange to need to go back and modify that file after the fact with any hard-coded values so I added the `kms:TagResource` action to the relevant statement and updated the IAM Group's policy with Terraform. Deploying again returned a "MalformedPolicyDocumentException" error which appears to be a [known issue] with this Terraform provider? Running the deploy step again got past that error but then returned a "…not authorized to perform lambda:CreateEventSourceMapping" error at which point I ended up giving up and deploying with an admin account.

## Desired Change

The least-privilege permissions Terraform file creates a working policy for deploy users.

[setup]: http://binaryalert.io/iam-group.html
[known issue]: https://github.com/hashicorp/terraform/issues/6576