Support StackPolicy for nested stacks

[DucQuach]

Name of the resource

AWS::CloudFormation::Stack

Resource name

No response

Description

Currently, if I have a CloudFormation stack that include a nested stack. For example:

NestedStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: ./path/to/template.yaml

And there are Stack Policies applied to the Root Stack

{
  "Statement" : [
    {
      "Effect" : "Deny",
      "Action" : ["Update:Replace", "Update:Delete"],
      "Principal": "*",
      "Resource" : "*",
      "Condition" : {
        "StringEquals" : {
          "ResourceType" : [
            "AWS::RDS::DBInstance"
          ]
        }
      }
    },
    {
      "Effect" : "Allow",
      "Action" : "Update:*",
      "Principal": "*",
      "Resource" : "*"
    }
  ]
}

These policies are NOT applied to the nested stack. As your infrastructure grows, it's a best practice to use Nested Stacks, and in this case, having Stack Policies applied to the Root Stack makes them useless because all of the resources are in the nested stacks. Can we have a way to set the Stack Policies for AWS::CloudFormation::Stack resource? Either using JSON or inherit from the root stack?

Other Details

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-nested-stacks.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html

[redaLaanait]

+1