Can I make the CloudFormationExecutionRole have least privilege?

### Describe your idea/feature/enhancement

I hope that the CloudFormationExecutionRole have least privilege.
Currently SAM-CLI attaches the following policy to the execution role:

```json
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "*",
"Resource": "*",
"Effect": "Allow"
}
]
}
```

This seems to allow CloudFormation to create/delete anything in an account including IAM resouces, even if I just wan't to deploy an API.

### Proposal

I hope that there were policy templates for tipical usecases such as an API or an S3 event handler.

### Additional Details