title: IAM Policy using Condition ec2:ResourceTag not working
body: <p>I have n x EC2 instances that I wish to limit ec2 actions to instances with the same key/value tag (I.E. platform=dev).</p>
  
  <p>I'm looking at doing this using an IAM Policy attached to the group their default IAM user is in.</p>
  
  <p>Policy:</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": "ec2:*",
          "Resource": "*",
          "Condition": {
              "StringEquals": {
                  "ec2:ResourceTag/tag:platform": "dev"
              }
          }
      }
  ]}
  </code></pre>
  
  <p>I set this up as per the online AWS docs: <a href="http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html" rel="noreferrer">Example Policies for Working With the AWS CLI or an AWS SDK</a></p>
  
  <p>I check it in the Policy Simulator and it works as expected (pass in a dev and it's allowed, otherwise denied).</p>
  
  <p>Then on one of the servers with the tag key/pair of platform=dev, I run <code>aws ec2 describe-instances</code> I get the response:</p>
  
  <pre><code>An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.
  </code></pre>
  
  <p>but if I remove the Condition it works. I don't understand what I'm doing wrong. Any help would be gratefully received!</p>