SQS IAM role generation does not follow the principle of least privilege

Automatic generation of IAM roles for an app that subscribes to an SQS queue will give the lambda permission to read and write to all SQS queues on the account.

Shouldn't the lambda only be given permission to read from the queue(s) passed to `@app.on_sqs_message`?

Start by tracing the automatic IAM role generation for applications using @app.on_sqs_message, then inspect how the subscribed SQS queues are represented. Done means the generated Lambda role grants access only to the queue or queues passed to @app.on_sqs_message, rather than all SQS queues in the account.

Written by the indexing model from the issue text.