InsufficientCapabilitiesException [CAPABILITY_NAMED_IAM] when creating a stack with IAM policies

Change --capabilities to CAPABILITY_NAMED_IAM

If you have IAM resources with custom names, you must specify CAPABILITY_NAMED_IAM. If you don't specify this parameter, this action returns an InsufficientCapabilities error.

https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html