List of required IAM permissions to `apply`

[mbattifarano]

It'd be great if the docs listed the minimum set of aws permissions needed to run gordon apply. The permission I eventually got to work are:

iam:*
s3:*
cloudformation:*
lambda:*

I'm happy to open a PR to update the docs, but I wanted to get some feedback on the list. In particular, if any of the permissions can be more specific.

[ericdmoore]

Agreed. Great idea to add to docs - assuming that is all that is needed.

[candlerb]

A minimal permission set would be very helpful. For example, iam:* is excessively broad: it allows creating users, adding users to groups, changing passwords etc.

[candlerb]

There is some excellent work in this area at serverless/serverless#1439