Per-function IAM permissions?

Can you make an example on how to do this with variables?