title: Adding additional sns:Unsubscribe to SNS access policy results in InvalidParameter error
body: <p>This one's a head scratcher:</p>
  
  <pre><code>sns_policy = {
      "Version":"2012-10-17",
      "Statement":[{ 
          "Effect" : "Allow",
          "Principal" : { "AWS": "*" },
          "Action" : ["sns:Publish", "sns:ListSubscriptionsByTopic", "sns:Unsubscribe"],
           "Resource" : "arn:aws:sns:us-west-2:234234234:test",
           "Condition" : {
               "ArnEquals" : { 
                   "aws:SourceArn" : "arn:aws:lambda:us-west-2:234234234:function:*"
               }
           }
      }]
  }
  
  sns.set_topic_attributes(TopicArn = "arn:aws:sns:us-west-2:234234234:test", 
      AttributeName = "Policy", 
      AttributeValue = json.dumps(sns_policy)
  ) 
  </code></pre>
  
  <p>Adding the third <code>Action</code> array item, <code>sns:Unsubscribe</code> results in <code>Invalid parameter: Policy statement action out of service scope! (Service: AmazonSNS; Status Code: 400; Error Code: InvalidParameter;</code> and removing <code>sns:Unsubscribe</code> works fine.</p>
  
  <p>Why is this not being allowed by AWS? I need my lambda function to be able to subscribe and unsubscribe Queues to SNS::test topic.</p>