AWSTemplateFormatVersion: '2010-09-09'
Description: 'Attach deny delete stack policy to CDK deploy role'

Parameters:
  Qualifier:
    Type: String
    Default: 'hnb659fds'
    Description: 'The qualifier used in the CDK bootstrap process'

Resources:
  DenyDeleteStackPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: !Sub 'deny-delete-stack-policy-${AWS::AccountId}-${AWS::Region}'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Deny
            Action:
              - cloudformation:DeleteStack
            Resource: '*'
      Roles:
        - !Sub 'cdk-${Qualifier}-deploy-role-${AWS::AccountId}-${AWS::Region}'

Outputs:
  DenyDeleteStackPolicyArn:
    Description: ARN of the Deny Delete Stack Policy
    Value: !Ref DenyDeleteStackPolicy

npm install cdk-nag --save-dev

# bin/cdk-nag-sample.ts
# 今回はAWS Solutionsのルール群を使用
#!/usr/bin/env node
import 'source-map-support/register';
import * as cdk from 'aws-cdk-lib';
import { CdkNagSampleStack } from '../lib/cdk-nag-sample-stack';
// 以下2行追記
import { AwsSolutionsChecks } from 'cdk-nag'
import { Aspects } from 'aws-cdk-lib';
const app = new cdk.App();
new CdkNagSampleStack(app, 'CdkNagSampleStack', {});
// 追記
Aspects.of(app).add(new AwsSolutionsChecks({ verbose: true }));