{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Deny",
    "Action": ["iam:Detach*", "iam:Delete*"],
    "Resource": ["arn:aws:iam::111222333444:role/IDC", "arn:aws:iam::111222333444:policy/Deny-S3"],
    "Condition": {
      "ArnNotEquals": {
        "aws:PrincipalArn": "arn:aws:iam::111222333444:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AdministratorAccess_111222333444"
      }
    }
  }
}