We've managed to mitigate this by doing cloudformation launches manually with the developer's own credentials, and have each resource take on the IAM role it ne

We've managed to mitigate this by doing cloudformation launches manually with the developer's own credentials, and have each resource take on the IAM role it needs. (Since you need sts:AssumeRole for CFN creation anyway, it's not really useful to limit the cloudformation role, it's going to be essentially admin in any event.)