User understands permissions needed to bootstrap

[lorenyu]

Context

add docs on permissions needed to bootstrap

• dynamodb:GetItem
• dynamodb:PutItem
• dynamodb:DeleteItem

The following might not be needed if we go with AWS managed key instead of customer key

To create customer key

• kms:EnableKeyRotation
• kms:ScheduleKeyDeletion
• kms:CreateGrant
• ... and more

To use customer key

• kms:Encrypt
• kms:Decrypt
• kms:GenerateDataKey permissions on this KMS key.
  (see terraform backends s3)

and others too

Implementation guidance from Shawn:

Easiest way to do that is give a fresh user admin privilege, deploy the whole setup and then use IAM to generate policies based on activity.