apply nested stack policy

cfn-policy.sh

function protect_nested_stacks() {
    local parent_stack=$1 stack_policy_file=$2
    local nested_stacks=$(aws cloudformation list-stack-resources \
        --stack-name ${parent_stack} \
        --query "StackResourceSummaries[?ResourceType=='AWS::CloudFormation::Stack'].[PhysicalResourceId]" \
        --output text
    )
    
    for stack in ${nested_stacks}; do
        aws cloudformation set-stack-policy --stack-name ${stack} --stack-policy-body file://${stack_policy_file}
        protect_nested_stacks ${stack} ${stack_policy_file}
    done
}

policy.json

{
  "Statement" : [
    {
      "Effect" : "Allow",
      "Action" : "Update:*",
      "Principal": "*",
      "Resource" : "*"
    },
    {
      "Effect" : "Deny",
      "Action" : ["Update:Replace", "Update:Delete"],
      "Principal": "*",
      "Resource" : "*",
      "Condition": {
      	"StringEquals" : {
          "ResourceType" : ["AWS::RDS::DBInstance"]
        }
      }
    }
  ]
}