Explain the IAM policy magic

There is some pretty cool stuff going on with IAM policies but it's not explained anywhere. It's kind of cool that it just happens automatically but you definitely need a section on how it works.

Also, for the S3 example I noticed the policy just wildcards the resource. Is there anyway to figure out the actual bucket name being used and restrict the policy to just that resource?

Also, what are the limitations? What things aren't really detectable using this approach? For example, if my Lambda function has an SNS event source, I think it would be very difficult if not impossible to figure that out from the code.