Note from maintainers: To have this possible, we need to first tackle #8396 PR's welcome!

Currently when I define IAM role statements on function level, they will override the default generated IAM role customized at the provider level. However there can be functions that would need additional permissions to operate properly. Following the principle of least privilege it would be great, if the IAM role generated for a function could not only replace the default role, but there would be an option to extend or customize the provider level role on function level.

Examples:

• I have multiple functions, but only 1 of them needs to access S3.
• I have multiple functions that needs to access S3, but only 1 of them needs to delete from S3.

If this is already possible, please extend to existing documentation to describe how.

Additional Data

• Serverless Framework Version you're using: 1.23.0

Thanks for creating and maintaining this project!