Helpful article, thanks. I use custom constructs to ensure consistency in common resources - for example S3 buckets always have encryption enabled, block public access etc. In Prod environments they also include RemovalPolicy.RETAIN (CDK also makes it very easy to delete a bucket full of objects, something that can't be done in vanilla CloudFormation).

It only takes one important DynamoDb table to go missing before you learn your lesson :)