Misc: documentation updates + bugfixes

[ryan-roemer]

Work

• Add warning have to re-initialize terraform when switching stages. Documentation updates #35
• Add notes and warnings about aws-vault + IAM + MFA stuff. Adds note about Docs: Research aws-vault usage with instructions for MFA for IAM roles stuff. #38 future work
• Update terrraform-aws-serverless to fix deploys. Fixes BUG: Layers function is missing permissions. #40 , BUG: Serverless Canary Plugin permissions aren't valid for -developer/-admin users #39

Sandbox Environment

I have now manually deleted the existing SLS + TF sandbox environments as they were compromised. Then I recreated both with the following:

# Re-init sandbox stage in local state as superadmin.
$ STAGE=sandbox aws-vault exec FIRST.LAST --no-session -- \
  yarn tf:service:init

# Create sandbox TF stack as superadmin.
$ STAGE=sandbox aws-vault exec FIRST.LAST --no-session -- \
  yarn tf:service:apply

# Create sandbox SLS as `-admin`
$ STAGE=sandbox aws-vault exec FIRST.LAST-admin --no-session -- \
  yarn lambda:deploy

# Re-deploy existing sandbox SLS as `-developer`
$ STAGE=sandbox aws-vault exec FIRST.LAST-developer --no-session -- \
  yarn lambda:deploy

[ryan-roemer]

@tptee -- I've reprovisioned TF and that's fine. Where I'm stuck is on SLS deploy:

$ STAGE=sandbox aws-vault exec FIRST.NAME-admin --no-session -- \
  yarn lambda:deploy

# ...

  Serverless Error ---------------------------------------
 
  An error occurred: CodeDeployServiceRole - API: iam:CreateRole User: arn:aws:iam::ACCOUNT:user/FIRST.NAME-admin is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::ACCOUNT:role/sls-simple-reference-sandbox-CodeDeployServiceRole-236BX48WS9ZX.

Looks like from generated resources from serverless-plugin-canary-deployments. What do we need to do to get that hooked up to our -admin role to be able to create?

Captured in #39

[ryan-roemer]

Another note: After a superadmin deploy to kick things off, get hung up with:

$ STAGE=sandbox aws-vault exec FIRST.LAST-developer --no-session --   yarn lambda:deploy

  Serverless Error ---------------------------------------
 
  An error occurred: LayersLambdaFunction - User: arn:aws:iam::ACCOUNT:user/FIRST.LAST-developer is not authorized to perform: iam:PassRole on resource: arn:aws:iam::ACCOUNT:role/tf-simple-reference-sandbox-lambda-execution (Service: AWSLambdaInternal; Status Code: 403; Error Code: AccessDeniedException; Request ID: ba06c923-6e39-46ee-9cb6-7d80fb6a399c).

Same for -admin