Technical Concepts
CloudFormation authorization
How the access grant is presented as one pre-filled stack rather than a policy you write, and why the acknowledgement cannot be removed.
What it is
A link that opens the CloudFormation console with the template, the stack name and every parameter already filled in. You review it and press Create.
Why it is a link and not a policy document
Because asking a customer to author an IAM policy transfers the security design to them, and the result is a policy nobody reviewed on either side.
A template can be read before it is deployed, is identical for every customer, and is testable.
The acknowledgement
AWS requires you to acknowledge that the stack creates IAM resources. That acknowledgement is the authorization, and it cannot be removed without GovIntel holding credentials in your account.
The template is served privately
The template is not published at a public address. The link carries a short-lived reference to it.
What you still decide
Whether the stack should create the GitHub identity provider. GovIntel has no access to your account until the role exists and therefore cannot check.
What it does not mean
Pre-filling parameters does not hide them. Every one is visible in the console before you create anything.