Describe the bug

Setting up a cluster with removalPolicy: cdk.RemovalPolicy.SNAPSHOT fails to synth because ec2.SecurityGroup does not supoort said RemovalPolicy

Expected Behavior

cdk synth executed correctly.

Current Behavior

cdk synth fails with Error: AWS::EC2::SecurityGroup does not support snapshot removal policy

Reproduction Steps

#!/usr/bin/env node
import * as cdk from 'aws-cdk-lib';
import * as docDb from 'aws-cdk-lib/aws-docdb';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import 'source-map-support/register';

const app = new cdk.App();
const env = {
  account: 'your account',
  region: 'your region',
};
const stack = new cdk.Stack(app, 'DocDB', {
  env,
});

new docDb.DatabaseCluster(stack, 'Cluster', {
  removalPolicy: cdk.RemovalPolicy.SNAPSHOT,
  masterUser: {
    username: 'test',
    password: cdk.SecretValue.unsafePlainText('test'),
  },
  instanceType: ec2.InstanceType.of(
    ec2.InstanceClass.T4G,
    ec2.InstanceSize.MEDIUM,
  ),
  vpc: ec2.Vpc.fromLookup(stack, 'VPC', { isDefault: true }),
});

Possible Solution

1. Fallback to retaining security group if document db has snapshot policy set
2. Do not set retention policy inside construct

Personally I prefer the 2nd idea, because setting a retention policy inside Construct does seem to be a bit of an odd idea.
I think setting up one with CDK defaults make more sense and if user wants to change the default it can always create a security group before hand and pass it as prop

Additional Information/Context

No response

CDK CLI Version

2.121.1

Framework Version

No response

Node.js Version

20.8

OS

MacOS sierra

Language

TypeScript

Language Version

5.3

Other information

No response