{
"Statement" : [
{
  "Effect" : "Deny",
  "Action" : "Update:*",
  "Principal": "*",
  "Resource" : "LogicalResourceId/ProductionDatabase"
},
{
  "Effect" : "Allow",
  "Action" : "Update:*",
  "Principal": "*",
  "Resource" : "*"
}
]
}

"Condition" : "CreateProdResources"

{
  "Statement" : [
  {
    "Effect" : "Deny",
    "Principal" : "*",
    "Action" : "Update:*",
    "Resource" : "*",
    "Condition" : {
      "StringEquals" : {
        "ResourceType" : ["AWS::EC2::Instance", "AWS::RDS::DBInstance"]
      }
    }
  },
  {
    "Effect" : "Allow",
    "Principal" : "*",
    "Action" : "Update:*",
    "Resource" : "*"
  }
  ]
}