CloudFormation basically needs full account permissions to do it's job. We use separate AWS accounts to provide isolation. It's not great, but we've found it workable.