Improve generated permissions for API Gateway

API Gateway Permissions don't work like normal Permissions (where the event matches the permission): http://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-control-access-using-iam-policies-to-create-and-manage-api.html

* [x] Basic support (as in, it generates policies that are valid and allow at least what was seen in event
* [ ] Test generated policies
* [ ] Add correct region in generated resource statements (currently `*`)
* [ ] Add correct ids (e.g `restapi_id`) in generated resource statements (currently `*`)