amazon ec2 - how to limit instance launch by instance type in AWS using IAM service -

i using policy limit runistances specific instance types , specific region. when run launch wizard or simulation under test user getting "implicitly denied" error.

here policy:

{   "version": "2012-10-17",   "statement": [     {       "effect": "allow",       "action": "ec2:runinstances",       "resource": [         "arn:aws:ec2:us-east-1::instance/*"       ],       "condition": {         "stringequals": {           "ec2:instancetype": [             "t1.micro",             "m1.small"           ]         }       }     },     {       "effect": "allow",       "action": "ec2:runinstances",       "resource": [         "arn:aws:ec2:us-east-1::image/ami-*",         "arn:aws:ec2:us-east-1::subnet/*",         "arn:aws:ec2:us-east-1::network-interface/*",         "arn:aws:ec2:us-east-1::volume/*",         "arn:aws:ec2:us-east-1::key-pair/*",         "arn:aws:ec2:us-east-1::security-group/*"       ]     },     {       "effect": "allow",       "action": [         "ec2:describe*",         "ec2:createsecuritygroup",         "ec2:deletesecuritygroup",         "ec2:authorizesecuritygroupingress",         "ec2:authorizesecuritygroupegress",         "ec2:createkeypair"       ],       "resource": [         "*"       ]     }   ] } 

could point issue?

in resource blocks, insert asterisk between 2 ":" in arn lines, specify accounts, or replace account number.

"arn:aws:ec2:us-east-1:*:instance/*"  "arn:aws:ec2:us-east-1:*:image/ami-*", "arn:aws:ec2:us-east-1:*:subnet/*", "arn:aws:ec2:us-east-1:*:network-interface/*", "arn:aws:ec2:us-east-1:*:volume/*", "arn:aws:ec2:us-east-1:*:key-pair/*", "arn:aws:ec2:us-east-1:*:security-group/*"