Restrict Lambda IAM permissions

[alexcasalboni]

The current role has full access to AWS Lambda:

iamRoleStatements:
    - Effect: Allow
      Action:
        - 'lambda:*'
      Resource: '*'

Since we want the lambdaARN to be given at runtime, we can't really restrict the Resource parameter. We could restrict the set of actions, though. Also, experienced users can always force Resource to be the Lambda Function(s) they want to optimize.

As far as actions are concerned, Initializer, Executor, Finalizer and Cleaner need the following Lambda permissions (only 7 out of 28):

• GetAlias
• UpdateFunctionConfiguration
• PublishVersion
• DeleteFunction (always with Qualifier)
• CreateAlias
• DeleteAlias
• Invoke