I think the difference is that CDK “compiles” down to CloudFormation. Whatever you do it still has to be valid compared to a random application that can do whatever whenever. OFC I’m ignoring the way CDK makes it easier to use (and sometimes encourages) custom providers backed by Lambdas.