title: IAM Policy Deny Deregister AMI
body: <p>I am using the policy below to prevent a particular user to deregister an AMI image but it doesn't work. I think that I have given correct region and AMI.</p>
  
  <pre><code>"Version": "2012-10-17",
  "Statement": 
       {
          "Action": "ec2:DeregisterImage*",
          "Effect": "Deny",
          "Resource": "arn:aws:ec2:region::image/image id"
       }
  </code></pre>