Verify IAM permissions on upgrade

[tj]

Currently if the policy changes the only way to notify customers is via the changelog, which is of course not ideal and can lead to confusing IAM errors.

• Does AWS have an API for checking this without making resource API calls?
• Add warning on upgrade (probably first deploy as well)

If AWS does not have this, I could maintain and diff a log of policy changes somewhere.

[courajs]

This may be what we want to use:
https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulatePrincipalPolicy.html