CloudFormation Stack Policy validation

### Resource Name

[AWS CloudFormation Stack Policy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html)

### Details

#### Request
Would it be possible to validate stack policies, similar to [IAM policies](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/accessanalyzer/validate-policy.html)?

#### Context
Not every region supports all CloudForm-able resource. The supported list is [here](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html), and also via the [list-types](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudformation/list-types.html) API. For example, `AWS::DocDB::DBCluster` is not supported in us-west-1, the following yields no results:

```bash
aws cloudformation list-types \
--visibility PUBLIC \
--type RESOURCE \
--region us-west-1 \
--filters Category=AWS_TYPES \
| jq '.TypeSummaries[] | select(.TypeName == "AWS::DocDB::DBCluster")'
```

#### Use case
Stack policies are very useful to [protect](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html) against accidental deletion/replacement of stateful resources, such as databases, buckets, etc. We have a CD tool for CloudFormation that:
1. Sets the stack policy to deny deletion of a set of stateful resources (see below)
2. Performs the deployment
3. If the deployment contains changes that would unintentionally destroy a database, the change is not applies and the deployment fails
4. Else the deployment is successful

Knowing that resource availability is region specific, the policy in 1 needs to be region-aware.

One way to do that is to use the `list-types` API[^1]. Another option could be to validate the policy before its application. Therefore, it would be useful to be able to validate a CloudFormation stack policy.

#### Example stack policy to protect stateful resources
The below policy is valid in eu-west-1 but _not_ in us-west-1 as `AWS::DocDB::DBCluster` is not supported in us-west-1. Without a validation API, validity is only known at runtime.

```json
{
"Statement" : [
{
"Effect" : "Deny",
"Action" : ["Update:Replace", "Update:Delete"],
"Principal": "*",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"ResourceType" : [
"AWS::RDS::DBInstance",
"AWS::DynamoDB::Table",
"AWS::DocDB::DBInstance",
"AWS::DocDB::DBCluster",
"AWS::Elasticsearch::Domain",
"AWS::SNS::Topic",
"AWS::SQS::Queue",
"AWS::Kinesis::Stream",
"AWS::ElasticLoadBalancing::LoadBalancer",
"AWS::ElasticLoadBalancingV2::LoadBalancer",
"AWS::CloudFront::Distribution",
"AWS::ApiGateway::RestApi",
"AWS::ApiGateway::DomainName",
"AWS::ApiGateway::BasePathMapping",
"AWS::ApiGateway::Stage",
"AWS::S3::Bucket",
"AWS::Route53::HostedZone",
"AWS::Route53::RecordSet",
"AWS::Route53::RecordSetGroup",
"AWS::EC2::EIP",
"AWS::EC2::InternetGateway",
"AWS::EC2::NatGateway",
"AWS::EC2::Route",
"AWS::EC2::RouteTable",
"AWS::EC2::Subnet",
"AWS::EC2::SubnetRouteTableAssociation",
"AWS::EC2::VPC",
"AWS::EC2::VPCEndpoint",
"AWS::EC2::VPCGatewayAttachment"
]
}
}
},
{
"Effect" : "Allow",
"Action" : "Update:*",
"Principal": "*",
"Resource" : "*"
}
]
}
```

[^1]: The `list-types` API is described as "Returns summary information about extension that have been registered with CloudFormation.". Are first-party resources classed as extensions?

The issue names no repository files, tests, or implementation entry point. Start by reviewing CloudFormation stack policy documentation and the list-types API behavior across regions. Done would mean a defined validation capability that reports whether a stack policy is valid for the target region before application.

Written by the indexing model from the issue text.