‫So now, let's do a quick lecture
‫on CloudFormation Stack policies.
‫So, when you have a CloudFormation Stack update, by default,
‫any action is going to be allowed on all resources
‫so you can change your stack as you wish,
‫but sometimes, you may want to protect your stack
‫against updates, or part of your stack against updates.
‫This is where Stack policies come in.
‫Stack policies are JSON documents,
‫and they define what update actions are allowed
‫on specific resources during Stack updates.
‫So here, we have an example where the first statement
‫is saying "Allow update*" on everything,
‫meaning that everything in your CloudFormation Stack
‫can be updated, and the second part is saying "Deny update*"
‫on Resource Production Database.
‫That means that whatever is named "Production Database"
‫in your CloudFormation Stack is going to be protected
‫against any kind of updates,
‫so by default, and your production database is fine.
‫So, the goal of Stack policies is really
‫to protect resources against unintentional updates
‫and when you set a Stack policy by default,
‫all the resources are protected,
‫and so what you need is to have an explicit "allow"
‫for the resources that you want to be allowed to be updated.
‫So, that's it.
‫You should know enough to answer maybe one question
‫on the exam on this.
‫I hope you liked it and I will see you in the next lecture.