i've been working on some IAM policies to deny access to certain databases. something like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor2",
            "Effect": "Deny",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::system-storage-bucket/system-name/datomic/access/dbs/db/my-restricted-db/*"
        }
    ]
}