diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ee257d316..889b48bf0 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -62,7 +62,7 @@ jobs:
           python tools/dev/dockerpkg.py build --scan --test -r cloudcustodian -i policystream
 
 
-  "Publish Distroless":
+  "Publish_Distroless":
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
diff --git a/c7n/resources/ami.py b/c7n/resources/ami.py
index 451570328..9db0b97b6 100644
--- a/c7n/resources/ami.py
+++ b/c7n/resources/ami.py
@@ -24,7 +24,7 @@ from c7n.filters import (
 from c7n.manager import resources
 from c7n.query import QueryResourceManager, DescribeSource, TypeInfo
 from c7n.resolver import ValuesFrom
-from c7n.utils import local_session, type_schema, chunks
+from c7n.utils import local_session, type_schema, chunks, merge_dict_list
 
 
 log = logging.getLogger('custodian.ami')
@@ -45,7 +45,10 @@ class AMI(QueryResourceManager):
         date = 'CreationDate'
 
     def resources(self, query=None):
-        query = query or {}
+        if query is None and 'query' in self.data:
+            query = merge_dict_list(self.data['query'])
+        elif query is None:
+            query = {}
         if query.get('Owners') is None:
             query['Owners'] = ['self']
         return super(AMI, self).resources(query=query)
diff --git a/c7n/utils.py b/c7n/utils.py
index 0528a1d8d..1af028a87 100644
--- a/c7n/utils.py
+++ b/c7n/utils.py
@@ -668,6 +668,17 @@ def get_annotation_prefix(s):
     return 'c7n:{}'.format(s)
 
 
+def merge_dict_list(dict_iter):
+    """take an list of dictionaries and merge them.
+
+    last dict wins/overwrites on keys.
+    """
+    result = {}
+    for d in dict_iter:
+        result.update(d)
+    return result
+
+
 def merge_dict(a, b):
     """Perform a merge of dictionaries a and b
 

Cannot set Owners for aws.ami resource
**Describe the bug**
My intent is to search all canonical public AMIs and return the most recent ones that match my filter. 

I'm unable to set the `Owners` key for `aws.ami`.

I'm also unable to find documentation on `Owners` key.

**To Reproduce**

Run policy

```
custodian-cask run -c test-policies/ami-new.yml --dryrun -s out --region us-east-1 --verbose --cache-period 0
```

**Expected behavior**
Search not my account but canonical's account to find the latest AMI

**Background (please complete the following information):**
 - Policy: [please exclude any account/sensitive information]
```yaml
policies:
  - name: ami-latest-canonical
    resource: ami
    query:
      # canonical owner
      Owners: ["099720109477"]
    filters:
      - type: image-age
        days: 60
        op: lte
```

```
2020-04-08 20:30:00,023: custodian.commands:ERROR invalid policy file: /home/custodian/ami-new.yml error: Failed to validate policy ami-new 
 Error on policy:ami-new resource:ami
{'Owners': ['099720109477']} is not of type 'array'

Failed validating 'type' in schema[14]['allOf'][0]['properties']['query']:
    {'items': {'type': 'object'}, 'type': 'array'}

On instance['query']:
    {'Owners': ['099720109477']}
2020-04-08 20:30:00,024: custodian.commands:ERROR Found 1 errors.  Exiting.
```

**Additional context**
Add any other context about the problem here.

diff --git a/tests/data/placebo/test_ami_sse/ec2.DescribeImages_1.json b/tests/data/placebo/test_ami_sse/ec2.DescribeImages_1.json
new file mode 100644
index 000000000..476902991
--- /dev/null
+++ b/tests/data/placebo/test_ami_sse/ec2.DescribeImages_1.json
@@ -0,0 +1,46 @@
+{
+    "status_code": 200,
+    "data": {
+        "Images": [
+            {
+                "Architecture": "x86_64",
+                "CreationDate": "2018-07-25T16:07:17.000Z",
+                "ImageId": "ami-b04847cf",
+                "ImageLocation": "123456789123/ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-20180724",
+                "ImageType": "machine",
+                "Public": true,
+                "OwnerId": "123456789123",
+                "State": "available",
+                "BlockDeviceMappings": [
+                    {
+                        "DeviceName": "/dev/sda1",
+                        "Ebs": {
+                            "DeleteOnTermination": true,
+                            "SnapshotId": "snap-03eeb5be1266fe28d",
+                            "VolumeSize": 8,
+                            "VolumeType": "gp2",
+                            "Encrypted": false
+                        }
+                    },
+                    {
+                        "DeviceName": "/dev/sdb",
+                        "VirtualName": "ephemeral0"
+                    },
+                    {
+                        "DeviceName": "/dev/sdc",
+                        "VirtualName": "ephemeral1"
+                    }
+                ],
+                "Description": "Canonical, Ubuntu, 18.04 LTS, amd64 bionic image build on 2018-07-24",
+                "EnaSupport": true,
+                "Hypervisor": "xen",
+                "Name": "ubuntu/images/hvm-ssd/ubuntu-bionic-18.04-amd64-server-20180724",
+                "RootDeviceName": "/dev/sda1",
+                "RootDeviceType": "ebs",
+                "SriovNetSupport": "simple",
+                "VirtualizationType": "hvm"
+            }
+        ],
+        "ResponseMetadata": {}
+    }
+}
diff --git a/tests/test_ami.py b/tests/test_ami.py
index 846f09168..a9c7ff986 100644
--- a/tests/test_ami.py
+++ b/tests/test_ami.py
@@ -37,6 +37,20 @@ class TestAMI(BaseTest):
         resources = p.run()
         self.assertEqual(len(resources), 1)
 
+    def test_ami_ssq(self):
+        factory = self.replay_flight_data('test_ami_sse')
+        p = self.load_policy({
+            'name': 'ubuntu-bionic',
+            'resource': 'aws.ami',
+            'query': [
+                {'Owners': ["123456789123"]},
+                {'Filters': [
+                    {'Name': 'name',
+                     'Values': ["ubuntu/images/hvm-ssd/ubuntu-bionic*"]}]}]},
+            session_factory=factory)
+        resources = p.run()
+        self.assertEqual(resources[0]['OwnerId'], '123456789123')
+
     def test_err_ami(self):
         factory = self.replay_flight_data("test_ami_not_found_err")
         ami_id = 'ami-123f000eee1f9f654'
diff --git a/tests/test_utils.py b/tests/test_utils.py
index 480c2d4d7..6d9b85f2f 100644
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -131,6 +131,12 @@ class ProxyUrlTest(BaseTest):
 
 class UtilTest(BaseTest):
 
+    def test_merge_dict_list(self):
+
+        assert utils.merge_dict_list([
+            {'a': 1, 'x': 0}, {'b': 2, 'x': 0}, {'c': 3, 'x': 1}]) == {
+                'a': 1, 'b': 2, 'c': 3, 'x': 1}
+
     def test_merge_dict(self):
         a = {'detail': {'eventName': ['CreateSubnet'],
                     'eventSource': ['ec2.amazonaws.com']},

pip install -e .
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-xdist pytest-mock pytest-asyncio
apt-get update apt-get install -y gcc
3.7
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
apipkg==1.5
appdirs==1.4.3
argcomplete==1.11.1
attrs==19.3.0
aws-xray-sdk==2.4.3
bleach==3.1.4
boto3==1.12.36
botocore==1.15.36
-e git+https://github.com/cloud-custodian/cloud-custodian.git@66e4d8718884829ce3e398a3467c16a534d0a917#egg=c7n
certifi==2020.4.5.1
cffi==1.14.0
chardet==3.0.4
coverage==5.0.4
cryptography==2.9
distlib==0.3.0
docutils==0.15.2
entrypoints==0.3
exceptiongroup==1.2.2
execnet==1.7.1
filelock==3.0.12
flake8==3.7.9
future==0.18.2
idna==2.9
importlib-metadata==1.6.0
iniconfig==2.0.0
jeepney==0.4.3
jmespath==0.9.5
jsonpatch==1.25
jsonpickle==1.3
jsonpointer==2.0
jsonschema==3.2.0
keyring==21.2.0
mccabe==0.6.1
mock==4.0.2
more-itertools==8.2.0
multidict==4.7.5
packaging==20.3
pkginfo==1.5.0.1
placebo==0.9.0
pluggy==0.13.1
psutil==5.7.0
py==1.8.1
pycodestyle==2.5.0
pycparser==2.20
pyflakes==2.1.1
Pygments==2.6.1
pyparsing==2.4.7
pyrsistent==0.16.0
pytest==7.4.4
pytest-asyncio==0.21.2
pytest-cov==2.8.1
pytest-forked==1.1.3
pytest-mock==3.11.1
pytest-xdist==1.31.0
python-dateutil==2.8.1
PyYAML==5.3.1
readme-renderer==25.0
requests==2.23.0
requests-toolbelt==0.9.1
s3transfer==0.3.3
SecretStorage==3.1.2
six==1.14.0
tabulate==0.8.7
toml==0.10.0
tomli==2.0.1
tox==3.14.6
tqdm==4.45.0
twine==3.1.1
typing_extensions==4.7.1
urllib3==1.25.8
vcrpy==4.0.2
virtualenv==20.0.16
wcwidth==0.1.9
webencodings==0.5.1
wrapt==1.12.1
yarl==1.4.2
zipp==3.1.0

name: cloud-custodian
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=22.3.1=py37h06a4308_0
  - python=3.7.16=h7a1cb2a_0
  - readline=8.2=h5eee18b_0
  - setuptools=65.6.3=py37h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.38.4=py37h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - apipkg==1.5
      - appdirs==1.4.3
      - argcomplete==1.11.1
      - attrs==19.3.0
      - aws-xray-sdk==2.4.3
      - bleach==3.1.4
      - boto3==1.12.36
      - botocore==1.15.36
      - c7n==0.9.0
      - certifi==2020.4.5.1
      - cffi==1.14.0
      - chardet==3.0.4
      - coverage==5.0.4
      - cryptography==2.9
      - distlib==0.3.0
      - docutils==0.15.2
      - entrypoints==0.3
      - exceptiongroup==1.2.2
      - execnet==1.7.1
      - filelock==3.0.12
      - flake8==3.7.9
      - future==0.18.2
      - idna==2.9
      - importlib-metadata==1.6.0
      - iniconfig==2.0.0
      - jeepney==0.4.3
      - jmespath==0.9.5
      - jsonpatch==1.25
      - jsonpickle==1.3
      - jsonpointer==2.0
      - jsonschema==3.2.0
      - keyring==21.2.0
      - mccabe==0.6.1
      - mock==4.0.2
      - more-itertools==8.2.0
      - multidict==4.7.5
      - packaging==20.3
      - pkginfo==1.5.0.1
      - placebo==0.9.0
      - pluggy==0.13.1
      - psutil==5.7.0
      - py==1.8.1
      - pycodestyle==2.5.0
      - pycparser==2.20
      - pyflakes==2.1.1
      - pygments==2.6.1
      - pyparsing==2.4.7
      - pyrsistent==0.16.0
      - pytest==7.4.4
      - pytest-asyncio==0.21.2
      - pytest-cov==2.8.1
      - pytest-forked==1.1.3
      - pytest-mock==3.11.1
      - pytest-xdist==1.31.0
      - python-dateutil==2.8.1
      - pyyaml==5.3.1
      - readme-renderer==25.0
      - requests==2.23.0
      - requests-toolbelt==0.9.1
      - s3transfer==0.3.3
      - secretstorage==3.1.2
      - six==1.14.0
      - tabulate==0.8.7
      - toml==0.10.0
      - tomli==2.0.1
      - tox==3.14.6
      - tqdm==4.45.0
      - twine==3.1.1
      - typing-extensions==4.7.1
      - urllib3==1.25.8
      - vcrpy==4.0.2
      - virtualenv==20.0.16
      - wcwidth==0.1.9
      - webencodings==0.5.1
      - wrapt==1.12.1
      - yarl==1.4.2
      - zipp==3.1.0
prefix: /opt/conda/envs/cloud-custodian

tests/test_utils.py::UtilTest::test_merge_dict_list
tests/test_ami.py::TestAMI::test_ami_cross_accounts tests/test_ami.py::TestAMI::test_ami_ssq tests/test_ami.py::TestAMI::test_deregister_delete_snaps tests/test_ami.py::TestAMI::test_err_ami tests/test_ami.py::TestAMI::test_err_get_ami_invalid tests/test_ami.py::TestAMI::test_err_get_ami_notfound tests/test_ami.py::TestAMI::test_query tests/test_ami.py::TestAMI::test_unused_ami_false tests/test_ami.py::TestAMI::test_unused_ami_true tests/test_ami.py::TestAMI::test_unused_ami_with_asg_launch_templates tests/test_utils.py::TestTesting::test_assert_regex tests/test_utils.py::Backoff::test_delays tests/test_utils.py::Backoff::test_delays_jitter tests/test_utils.py::Backoff::test_retry_errors tests/test_utils.py::Backoff::test_retry_passthrough tests/test_utils.py::UrlConfTest::test_parse_url tests/test_utils.py::ProxyUrlTest::test_all_proxy_with_full_url tests/test_utils.py::ProxyUrlTest::test_http_proxy_with_full_url tests/test_utils.py::ProxyUrlTest::test_http_proxy_with_relative_url tests/test_utils.py::ProxyUrlTest::test_no_proxy tests/test_utils.py::UtilTest::test_camel_case tests/test_utils.py::UtilTest::test_camel_nested tests/test_utils.py::UtilTest::test_chunks tests/test_utils.py::UtilTest::test_date_time_decoder tests/test_utils.py::UtilTest::test_format_date tests/test_utils.py::UtilTest::test_format_event tests/test_utils.py::UtilTest::test_format_string_values tests/test_utils.py::UtilTest::test_generate_arn tests/test_utils.py::UtilTest::test_group_by tests/test_utils.py::UtilTest::test_ipv4_network tests/test_utils.py::UtilTest::test_load_error tests/test_utils.py::UtilTest::test_load_file tests/test_utils.py::UtilTest::test_local_session_region tests/test_utils.py::UtilTest::test_merge_dict tests/test_utils.py::UtilTest::test_parse_s3 tests/test_utils.py::UtilTest::test_reformat_schema tests/test_utils.py::UtilTest::test_set_annotation tests/test_utils.py::UtilTest::test_snapshot_identifier tests/test_utils.py::UtilTest::test_type_schema
.github/workflows/docker.yml c7n/utils.py c7n/resources/ami.py
.github/workflows/docker.yml c7n/utils.py c7n/resources/ami.py