Just a clarification: NONE of your App's code will run using such "AdministratorAccess" policies. Each function will run in its own iam:Role with limited permi

Just a clarification: NONE of your App's code will run using such "AdministratorAccess" policies. Each function will run in its own iam:Role with limited permissions defined by the developer. The AdministratorAccess is currently required only for the CLI but, as said in my previous comment, we'll eventually move to using a Service Role and providing a more restrictive policy.