wish: document the IAM minimal permissions need to deploy to Lambda and update API Gateway.

[markstos]

A great user experience might be to expect that setup is done with a "Power User" account.

At this stage an IAM user would be created for the purpose of deploying to this API and a policy would be attached to it that restricts it to managing just the functions.

Publishing a sample IAM policy for others to use would also be helpful.