title: AWS S3 IAM grant access to buckets based on tags
body: <p>I'm trying to grant a group of users access to all s3-buckets with a certain tag, but no access to all others.
  The policy I've cobbled together looks like this:</p>
  
  <pre><code>    {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "AllowListAll",
              "Effect": "Allow",
              "Action": [
                  "s3:ListAllMyBuckets"
              ],
              "Resource": [
                  "arn:aws:s3:::*"
              ]
          },
          {
              "Sid": "AllowAllIfGroup",
              "Effect": "Allow",
              "Action": [
                  "s3:*"
              ],
              "Condition: : {
                  "StringEquals" : {
                          "s3.ResourceTag/allow-group": "s3-access-group"
                  }
              },
              "Resource": [
                  "arn:aws:s3:::*",
                  "arn:aws:s3:::*/*"
              ]
          }
      ] 
  }
  </code></pre>
  
  <p><del>and I can't get it to work</del> I have tried simulating the policy for ListBucket and ListAllMyBuckets against the arn of a tagged Bucket, ListAllMyBuckets works, ListBucket fails.  </p>
  
  <p>If I adapt this policy to ec2 (as in 'grant start/stop/terminate to instances if tag matches') it works like a charm.</p>
  
  <p>Is this possible at all or does S3 not allow for matching buckets this way?</p>
  
  <p>(further clarification: my bucket has tags "allow-group" and "AllowGroup" set, I was not sure if the dash may be a problem)</p>