title: determine required permissions for AWS CDK
body: <p>I'm working with AWS CDK and every time I go to create a new resource (CodePipeline, VPC, etc) I end up in the same loop of...</p>
  
  <ul>
  <li>try to deploy</li>
  <li>"you are not authorized to foo:CreateBar"</li>
  <li>update IAM permissions</li>
  <li>try to deploy</li>
  <li>"you are not authorized to baz:CreateZzz"</li>
  <li>update IAM permissions</li>
  </ul>
  
  <p>...over and over again. Then the same when I <code>cdk destroy</code>, but for "foo:DeleteFoo"</p>
  
  <p>Is there a more efficient way to determine what permissions a policy needs to perform a certain CDK action? Maybe somewhere in the documentation I can reference?</p>
  
  <p>Thanks</p>