AWS SCPs With Tags Not Working

Hello,

I tried to follow the example in https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_ec2-start-stop-tags.html.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "StartStopIfTags",
            "Effect": "Allow",
            "Action": [
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:DescribeTags"
            ],
            "Resource": "arn:aws:ec2:region:account-id:instance/*",
            "Condition": {
                "StringEquals": {
                    "ec2:ResourceTag/Project": "DataAnalytics",
                    "aws:PrincipalTag/Department": "Data"
                }
            }
        }
    ]
}

But the Policy editor keep complaining with error "The provided policy document does not meet the requirements of the specified policy type.".

Please take note that I copied this directly from the documentation.

But when the Effect is changed to 'Deny', it accepts it.. Any idea why this is so?