Restricting access to EC2 instances using IAM Policy

Hi all,

I'm trying to restrict access to EC2 instances (especially describe-instances) to a IAM User with a IAM Policy (using Tags) as described in the following post: https://aws.amazon.com/premiumsupport/knowledge-center/iam-ec2-resource-tags/

I added the following tag "Environment/Labs" to few EC2 instances.

I then created the following IAM Policy that I attached to a IAM user.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/Environment": "Labs"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": [
                "ec2:DeleteTags",
                "ec2:CreateTags"
            ],
            "Resource": "*"
        }
    ]
}

Unfortunately, this is not working and I'm able to list all the instances. ;(

Any hint on what I'm missing here?

Note: I tried to attach the condition to the Describe*/DescribeInstances action and this was blocking any access to EC2 instances.

Many thanks in advance for the help, Best regards, Fred