Document least permissions required to bootstrap and deploy

[ghost]

This might help: https://aws.amazon.com/blogs/security/use-iam-access-analyzer-to-generate-iam-policies-based-on-access-activity-found-in-your-organization-trail/