stack_policy.json

{
  "Statement" : [
    {
      "Effect" : "Deny",
      "Action" : "Update:*",
      "Principal": "*",
      "Resource" : "*",
      "Condition" : {
        "StringEquals" : {
          "ResourceType" : ["AWS::RDS::DBInstance"]
        }
      }
    },
    {
      "Effect" : "Allow",
      "Action" : "Update:*",
      "Principal": "*",
      "Resource" : "*"
    }
  ]
}

stack_template.yml

---
AWSTemplateFormatVersion: '2010-09-09'
Description: test
Resources:
  TestSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: test

task.yml

---
- hosts: localhost
  connection: local
  tasks:
  - cloudformation:
      stack_name: issue31931
      region: "us-west-2"
      template: stack_template.yml
      stack_policy: stack_policy.json
      #template_parameters:
      #  env: "{{ aws_shop_env }}"