I like in https://serverless.com/ 's serverless.yml how it provisions the CloudFormation stuff and gives you a way to manage IAM permissions.
But SAM is certainly a valid option if you are OK with vendor lock in. (which many people are)
So if you don't rely on the cross-provider features Serverless offers I suggest to take a look at CloudFormation + SAM instead.
I have tried kappa (Python) and node-lambda (Node.js), and serverless works better than both of them, is more frequently updated (Lambda and API Gateway themselves change frequently), supports more languages (I have used it with Java, Python and Node.js) and has a much larger, more active community.
The API gateway support is pretty simple and solid, and they also allow you to use cloud formation rules directly so it is very flexible.