title: Is there a tool that will tell me what permissions will be required to create a Cloudformation template?
body: <p>My team is attempting to move towards templatization of our services and their infrastructure.</p>
  
  <p>We have found it to be extremely time-consuming to determine the set of permissions required to execute or update a given Cloudformation template. Our process is:</p>
  
  <ol>
  <li>Create a user with permissions <code>cloudformation:CreateStack</code> and/or <code>cloudformation:UpdateStack</code></li>
  <li>Have that user attempt to create/update the specified stack</li>
  <li>Observe which missing permission caused the stack operation to fail</li>
  <li>Add that permission to the user</li>
  <li>Go to 2.</li>
  </ol>
  
  <p>The alternative to this would be to create a "God User" who has unlimited permissions and have that user execute the create/update - which seems to violate the <a href="https://en.wikipedia.org/wiki/Principle_of_least_privilege" rel="nofollow noreferrer">Principle Of Least Privilege</a></p>
  
  <p>Alternatively, is there a tool that can list "what permissions have been exercised by a given user in the past N minutes?". If such a tool existed, we could create the "God User", have them execute the template, and then create a more limited-scope user that has precisely the permissions that the God User had used.</p>