Add KMS permission(s) that may be optionally needed

I had to create an IAM policy with **kms:CreateGrant** permission for the KMS key I was using with my Lambda functions, and then attach this manually to the solution's Lambda IAM roles.

It would be great to be able to optionally pass the KMS key ARN and add the necessary permission(s) as part of the solution.