There's a new tool around that helps these cases be prevented at an organization level called CfnGuard: https://aws.amazon.com/about-aws/whats-new/2020/06/introduci...

Obviously you have to be using CloudFormation, so if they're using i.e. Terraform they're out of luck.