BTW, there's no reason I can see that the condition couldn't work in both cases, but apparently this is up to the API/service to implement. The condition for Cr

BTW, there's no reason I can see that the condition couldn't work in both cases, but apparently this is up to the API/service to implement. The condition for CreateTags is: Condition: StringLike: aws:userid: "*:${ec2:InstanceID}" Documented (sorta) across four(!) pages: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-userid https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p... https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p... https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policy-structure.html#ec2-supported-iam-actions-resources https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-poli... https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonec2.html#amazonec2-actions-as-permissions https://docs.aws.amazon.com/service-authorization/latest/ref...