protect RDS against accidental deletion independent of its own deletion protection setting

policy.tf

data "aws_iam_policy_document" "deletion_protection" {
  statement {
    sid    = "DenyRDSDeletion"
    effect = "Deny"
    actions = [
      "rds:DeleteDBInstance",
      "rds:DeleteDBCluster"
    ]
    resources = ["*"]
    condition {
      test     = "StringNotEquals"
      variable = "rds:db-tag/deletion_protection"

      values = [
        false
      ]
    }
  }
}

resource "aws_iam_policy" "deletion_protection" {
  name        = "Deny-accidental-deletion"
  description = "Deletion protection for certain resources"
  policy      = data.aws_iam_policy_document.deletion_protection.json
}