CloudFormation basically needs full account permissions to do it's job. We use separate AWS accounts to provide isolation. It's not great, but we've found it workable.

Agreed, but you can make it manageable if you do it a lot. First give your CF runner full permissions. Then once you have your CF done and working, take away all permissions from your CF runner. Then add them back one by one as it fails.

You can even build a script to run it, check the errors, update IAM, and then run it again.

Eventually you'll have a set of IAM least privilege rules. It's a pain but it's secure.