Dave Connell

Improve CDK spoke account handling

4

Fix #9248 - handle more than one "spoke" account in CDK. Added to documentation. Reduced deployed IAM role permissions for safety: removed iam:* and other write-enabling permissions.

Resolves #608 Change output for error message to stderr so `-o json` continues to output valid json when stdout is redirected

Still need to make sure that terraform knows the binary has changed on update: https://www.terraform.io/docs/providers/aws/r/lambda_function.html#source_code_hash perhaps? Can we find a way to set the latest binary version name as a...