title: Restrict an AWS action unless two people confirm it. Is it possible?
body: <p>I am setting up a Disaster Recovery architecture for our AWS infrastructure and modelling all of it on Cloud Formation.</p>
  
  <p>All the devs have power-user privileges to the infrastructure and make frequent changes depending on their needs. Naturally this messes up my Cloud Formation template.</p>
  
  <p>Is there a way to restrict an action [eg add a new TCP rule in a sec group] so that must be approved by another person [me] before it takes effect ?</p>
  
  <p>That way I could monitor the changes [that the devs forget to notify me about] and the Cloud Formation template would be always up to date and depicting the real thing. </p>
  
  <p><em>Note1</em>:</p>
  
  <p>I have set up some event subscriptions [for RDS for starters] but I am not sure if they are the best/complete solution. </p>
  
  <p><em>Note2</em>:</p>
  
  <p>The confirmation for an action could be useful for critical actions like modifying / deleting / terminating EC2 and/or RDS instances.</p>