Programmatic way to add Lambda configurations and IAM role configurations

[gweiying]

In a recent deployment, the bulk deployment flow broke because the staging lambda IAM roles did not have sufficient permissions to read the SQS queue and access the S3 bucket for storing the QR codes. The roles were redeployed in a previous push to staging, and the lambda custom permissions were lost.

We should look into how the IAM permissions (and Lambda configurations) can be programmatically added.