Feature request: SAM needs to give a list of all permissions required to deploy a build once built

### Proposal
There needs to be a way to get SAM to report &/ test for all the required permissions,

There are several ways this could be implemented by default after a build or validate it gives a list of permissions required to deploy, this could be via a CLI Argument. or a Validate could actually test against the current credentials to see if all the permissions are present and only report on the missing ones.

### Additional Details
It is outright unfeasible and an outright waste of resources both users of SAM and AWS's to have users send a stack up Cloud Formation start to process it get so far though and then go oh permission is missing roll back everything, this is so damn waste full not to mention that it reports only 1 permission at once meaning it can take hundreds of repeats of deploy, start, process..., fail, rollback.

Another thing while I'm talking about permissions is why is SAM's default to create a new role for every single lambda even if there is nothing custom about the role, why do it not by default go there is 1 or more lambda without permissions create 1 role and use it for all without permissions.