SQS IAM role generation does not follow the principle of least privilege

[czieglerAC]

Automatic generation of IAM roles for an app that subscribes to an SQS queue will give the lambda permission to read and write to all SQS queues on the account.

Shouldn't the lambda only be given permission to read from the queue(s) passed to @app.on_sqs_message?

[jamesls]

Yes, we should be able to update this to only allow permission to the specific queue.