Some people claim it's the wrong way, because it's another abstraction between a CFN-template and the CFN-engine (more moving parts, etc) and using a markup language that restricts you a bit, makes things more manageable.
Essentially: Even when Infrastructure as Code exists, IAC developers can still make security mistakes. Our goal with this tool was to automate the process (it is way faster to build policies with this), and by default, restrict actions according to resource ARNs. I haven't seen any other tool do that to this degree, although I would be pleasantly surprised to learn about any that do.
Edit: Not sure why HN is blocking out the wildcard character.
Some of the higher level constructs apply smart rules. Eg adding a load balancer target adds restricted access rules.
It's still hard to know what's been created and how everything is connected.
I made a graph visualization tool that live updates from a Cloudformation file. It solved all my visibility and understanding issues. I plan to release it soon.