Why does functionbeat for AWS need to be able to make Cloudformation actions?

The

IAM permissions doc for functionbeat

lists a bunch of Cloudformation actions to be granted. What are they needed for? For the deployment process only, or something else?

Thanks

@kvch Could you help on this one please? Thanks!!