Provide IAM guidance with regards to SAM permissions required to develop/deploy Lambdas

### Describe your idea/feature/enhancement

Currently, it seems that SAM requires `iam:CreateRole` for a profile when attempting to run `sam deploy --guided`. It would be useful if the SAM CLI were able to query an AWS profile's capabilities to see if deployment can proceed. As a consequence of failed deployment, the Cloudformation stack must also be manually deleted.

### Proposal

There are a few things that would improve the developer experience in this regard:

1. Provide the AWS profile being used for the `sam deploy` in the output.
1. Provide a subcommand (or include it in the deployment workflow) where the AWS profile capabilities are checked prior to running the deployment.
1. Provide a way to clean up Cloudformation resources when a deployment fails due to a permission issue.
1. Provide guidance with regards to the required permissions to succeed on the deployment operation.

Things to consider:
[ ] The [SAM documentation](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-specification.html) will need to be updated

### Additional Details

The lack of feedback in the tool impacts the developer UX and adoptability of AWS SAM.