Add policy validation to CDK

[otaviomacedo]

Description

Add a new feature to the AWS CDK, that allows users to validate their CDK applications against externally defined policies. These policies are constraints on the properties and shape of the resources that can be created in an AWS account. For instance, a policy may specify that all S3 buckets should be encrypted using a customer managed KMS key, and that the KMS key, in turn, must have certain policies attached to it.

There are many tools in the market that allow customers to define these policies using a domain specific language (DSL) or a library written in a general purpose programming language. Taking a set of CloudFormation templates and a set of policies, these tools check whether any template violates any policy and report the violations to the user accordingly. This launch allows users to integrate one or more of these tools in the CDK synthesis flow, so that, if their application produces a non-compliant CloudFormation template, they get the feedback immediately.

This feature should be extensible, to allow any user to integrate with their own tools, without depending on changes to the CDK CLI or framework.

Roles

Role	User
Proposed by	@otaviomacedo
Author(s)	@otaviomacedo, @corymhall
API Bar Raiser	@iliapolo
Stakeholders	@evgenyka, @udaypant

See RFC Process for details

Workflow

• Tracking issue created (label: status/proposed)
• API bar raiser assigned (ping us at #aws-cdk-rfcs if needed)
• Kick off meeting
• RFC pull request submitted (label: status/review)
• Community reach out (via Slack and/or Twitter)
• API signed-off (label api-approved applied to pull request)
• Final comments period (label: status/final-comments-period)
• Approved and merged (label: status/approved)
• Execution plan submitted (label: status/planning)
• Plan approved and merged (label: status/implementing)
• Implementation complete (label: status/done)

---

Author is responsible to progress the RFC according to this checklist, and
apply the relevant labels to this issue so that the RFC table in README gets
updated.