Dynamically generate the S3 access policy

[Richard-Hansen]

It would be nice to have the access policy used by the remote S3 bucket to exactly match the IAM roles deployed by Terraform, and thus not require manual intervention.

Perhaps Terraform could manage the creation of this S3 bucket, and set the access policy at the same time.