Forbid IAM user to assume role with every tag, except defined ones

Okay, i suppose i found the answer myself, i probably need to add something like

            "Condition": {
                "StringEquals": {
                    "iam:ResourceTag/SSMSessionRunAs": "${aws:username}"
                }
            }

to the "Trust relationship" in the Role. Then each user will need to provide exact the same Tag while assuming the role as their IAM username is, and by using this separation i can separate users in EC2 instance.