A company uses CloudFormation to deploy infrastructure and is concerned that deleting a production stack could also delete important data in Amazon RDS databases or Amazon EBS volumes. How can the company prevent accidental deletion of those data resources when a stack is deleted?

The DeletionPolicy attribute in CloudFormation is specifically designed to control what happens to a resource when its containing stack is deleted. Setting DeletionPolicy: Retain for RDS databases and EBS volumes ensures these resources are preserved even if the CloudFormation stack that created them is deleted. This directly addresses the concern of accidental data loss. Configuring a stack policy forbids updates to specified resources, not deletion of the resources themselves when the stack is deleted. Updating IAM policies to deny deletion based on tags is a reactive measure that could prevent deletion, but it's less integrated with CloudFormation's lifecycle management and might require additional operational overhead. AWS Config rules are for auditing and enforcing compliance, not for directly preventing resource deletion during a CloudFormation stack deletion event.