Feature Request : per-function IAM policies

Yeah the framework does need this.

@horike37 what do you think?