iam:GetRole still needed

[Brian Candler]

According to changelog comment 44e92e7, "Adding aws-account-id to your settings will make gordon not require any IAM permissions" as of commit fba74a0.

But this needs clarification. Whilst gordon itself may not perform an IAM lookup, it still needs IAM permissions in order to deploy a stack.

Even when providing aws-account-id I still needed to provide these or else I got cloudformation failures:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1503051480000",
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:PutRolePolicy",
                "iam:DeleteRole",
                "iam:DeleteRolePolicy",
                "iam:GetRole"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

The first four were required to get as far as creating the stack, and GetRole seems to be required as part of lambda deployment:

CREATE_FAILED | AWS::Lambda::Function | ContribLambdasVersion | AccessDenied. User doesn't have permission to call iam:GetRole

Relates to #124.