Service Control Policy - Availability Zones

Yes you can do this, this policy blocked me from launching an ec2 instance in "us-east-1a"

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Deny",
      "Action": [
        "ec2:*"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "ForAnyValue:StringEquals": {
          "ec2:AvailabilityZone": [
            "us-east-1a"
          ]
        }
      }
    }
  ]
}

Decoded failure message

{
  "allowed": false,
  "explicitDeny": true,
  "matchedStatements": {
    "items": [
      {
        "statementId": "Statement1",
        "effect": "DENY",
        "principals": {
          "items": [
            {
              "value": "xxxxxxxxxxxxxxxx"
            }
          ]
        },
        "principalGroups": {
          "items": []
        },
        "actions": {
          "items": [
            {
              "value": "ec2:RunInstances"
            },
            {
              "value": "ec2:*"
            }
          ]
        },
        "resources": {
          "items": [
            {
              "value": "*"
            }
          ]
        },
        "conditions": {
          "items": [
            {
              "key": "ec2:AvailabilityZone",
              "values": {
                "items": [
                  {
                    "value": "us-east-1a"
                  }
                ]
              }
            }
          ]
        }
      }
    ]
  },

You can add an inline policy and add a condition to to restrict access to availability zone.