IAM policy example with "dual resource requirement". `kms:CreateAlias` action creates an alias (untaggable) referencing a key (taggable). Breaking alias resource permission into two statements `AllowAllOnTaggedKeys` and `AllowAllOnAliasResource` restricts access to keys w/ the required tag but any alias (b/c untaggable).

IAM policy - KMS access by key tag - "Dual Resource Requirement"

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "AllowCreateKeyWithTagInRequest",
			"Effect": "Allow",
			"Action": [
				"kms:CreateKey"
			],
			"Resource": "*",
			"Condition": {
				"StringEquals": {
					"aws:RequestTag/owner": "austin"
				}
			}
		},
		{
			"Sid": "AllowAllOnTaggedKeys",
			"Effect": "Allow",
			"Action": "kms:*",
			"Resource": "arn:*:kms:*:*:key/*",
			"Condition": {
				"StringEquals": {
					"aws:ResourceTag/owner": "austin"
				}
			}
		},
		{
			"Sid": "AllowAllOnAliasResource",
			"Effect": "Allow",
			"Action": "kms:*",
			"Resource": "arn:*:kms:*:*:alias/austin/*"
		},
		{
			"Sid": "DenySettingUnauthorizedTagValue",
			"Effect": "Deny",
			"Action": [
				"kms:TagResource"
			],
			"Resource": "*",
			"Condition": {
				"StringNotEquals": {
					"aws:RequestTag/owner": "austin"
				}
			}
		},
		{
			"Sid": "DenyRemovingTag",
			"Effect": "Deny",
			"Action": [
				"kms:UntagResource"
			],
			"Resource": "*",
			"Condition": {
				"ForAnyValue:StringEquals": {
					"aws:TagKeys": "owner"
				}
			}
		}
	]
}