More sane IAM permissions

## Description

Hi there,
We've come up with a more restrictive set of IAM permissions (instead of allowing global access to s3, IAM, ec2 and many others which is unacceptable in many environments)

The first is an apex general policy:

```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"acm:ListCertificates",
"acm:DescribeCertificate",
"iam:GetRole",
"iam:PassRole",
"lambda:AddPermission",
"lambda:Create*",
"lambda:Delete*",
"lambda:Get*",
"lambda:InvokeFunction",
"lambda:List*",
"lambda:RemovePermission",
"lambda:Update*",
"logs:Create*",
"logs:Describe*",
"logs:FilterLogEvents",
"logs:Put*",
"logs:Test*",
"route53:ListHostedZonesByName"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": "apigateway:*",
"Resource": "arn:aws:apigateway:*::/*"
}
]
}
```
A TODO here is to lockdown the apigateway perms further but the risk to the account is significantly lower than global s3 and IAM and Route53 access

A secondary policy grants access to the specific function in question

```
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "iam:PutRolePolicy",
"Resource": "arn:aws:iam:::role/-function"
},
{
"Effect": "Allow",
"Action": [
"iam:ListPolicies",
"ssm:PutParameter",
"ssm:DescribeParameters",
"ssm:GetParametersByPath",
"ssm:GetParameters",
"ssm:GetParameter"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:Create*",
"cloudformation:Delete*",
"cloudformation:Describe*",
"cloudformation:ExecuteChangeSet",
"cloudformation:Update*"
],
"Resource": "arn:aws:cloudformation:::stack//*"
},
{
"Effect": "Allow",
"Action": [
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::up--"
]
},
{
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObject"
],
"Resource": [
"arn:aws:s3:::up--/*"
]
}
]
}
```
A TODO here is to further lock down the perms on SSM and to restrict the S3 access to the specific function in question (just restricts to the up folder for now)