This guide describes how to grant IAM permissions in an Amazon account, but only through CloudFormation.

1. First, create a role called cloudformation which has permission to do everything an engineer might need to do.

2. Give that role a trust policy which will allow only AWS CloudFormation to actually use it:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudformation.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

3. Create a separate IAM policy, which will allow users to invoke CloudFormation, and pass in the role which grants elevated permissions.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:*"
      ],
      "Resource": [
        "*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:GetRole",
        "iam:PassRole"
      ],
      "Resource": "arn:aws:iam::*:role/cloudformation"
    }
  ]
}

4. When engineers invoke Cloudformation, pass the --role-arn flag and specify the ARN of your cloudformation role. See the docs on cloudformation:CreateStack for details.