AWS IAM Show only untagged EC2 instances

Question

I\'m attempting to introduce a guest IAM policy to restrict the access to the EC2 instances. I\'m trying to reach that, the guest policy shows only that instances,

Answer 1

I think that when you have multiple conditions on a single IAM statement, they are handled in an AND situation, meaning that both must be true.

Try using 2 statements, each with a single condition:

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "VisualEditor0",
        "Effect": "Allow",
        "Action": [
            "ec2:Describe*"
        ],
        "Resource": "*",
        "Condition": {
            "StringEquals": {
                "ec2:ResourceTag/Department": "Guest"
            }
        }
    },
    {
        "Sid": "VisualEditor1",
        "Effect": "Allow",
        "Action": [
            "ec2:Describe*"
        ],
        "Resource": "*",
        "Condition": {
            "Null": {
                "ec2:ResourceTag/Department": "true"
            }
        }
    }
]}