A SysOps administrator manages a production CloudFormation stack that includes an RDS DB instance and several EC2 instances. During routine stack updates, developers occasionally submit template changes that would inadvertently replace or delete the RDS DB instance, causing data loss. The administrator wants to prevent updates to the RDS resource specifically while still allowing updates to the EC2 resources through the normal update process. What should the administrator implement?