Recommend common further restrictions

[0xdabbad00]

For privileges such as ec2:CreateTags you probably want to restrict this to a resource, restrict this to an action, and restrict this to a set of tags. See example from managed policy.

https://github.com/z0ph/aws_managed_policies/blob/bb9b0ee3473b852e2488a449dc2ae85c53e0d7a1/policies/FMSServiceRolePolicy#L281

{
                    "Effect": "Allow",
                    "Action": "ec2:CreateTags",
                    "Resource": "arn:aws:ec2:*:*:route-table/*",
                    "Condition": {
                        "StringEquals": {
                            "ec2:CreateAction": "CreateRouteTable"
                        },
                        "ForAllValues:StringEquals": {
                            "aws:TagKeys": [
                                "Name",
                                "FMManaged"
                            ]
                        }
                    }
                },