More restrictive AWS permissions for Rebels

[vrivellino]

Create a set of default AWS permissions for promotably staff that is a bit more restrictive. For example:

• read-only all the things
• view billing
• full-control of limited S3 buckets
• perms needed to run all apps
• ability to assume Ops role (which is less restrictive)