What happens if a role triggers a cloudformation run?

I was trying to get the right permissions for a role that does a [sls](https://serverless.com/framework/) deploy which, under the covers, does cloudformation operations. It looks like the generated policy does not include the operations that cloudformation executed. Do we need to search for them in a different way?

Start by reproducing the Serverless (sls) deploy described in the issue and inspect the resulting CloudFormation operations and generated policy. Compare those operations with the CloudTrail data used by trailscraper; done means establishing why the operations are absent and documenting or addressing the required search behavior.

Written by the indexing model from the issue text.