title: Within IAM, can I restrict a group of users to access/launch/terminate only certain EC2 AMIs or instances?
body: <p>What the title says.</p>
  
  <p>Within the master AWS account, I have several personal accounts, i.e. <a href="http://aws.amazon.com/iam/">AWS Identity and Access Management (IAM)</a> users. I would like to assign certain IAM users to groups and prevent them from terminating certain <a href="http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Instances.html">Amazon EC2 instances</a>, de-registering certain <a href="http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIs.html">Amazon Machine Images (AMIs)</a>, etc.</p>
  
  <p>I don't mind if they're playing with their own stuff, but I don't want them to touch my stuff.</p>
  
  <p>Is that possible?</p>