Issue restraining access to a single environment on AppConfig using IAM Policy

Hello, For a while now I'm trying to restrict write access to a specific environment under AppConfig but it doesn't seem to work. I get access denied on "dev" environment. I have checked with the reference for appconfig (https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsappconfig.html). I want to allow developers to be able to start a deployment only on dev environment but not on prod. Here is the policy I am using.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "appconfig:StartDeployment",
            "Resource": [
                "arn:aws:appconfig:*:ACCOUNT-ID:deploymentstrategy/*",
                "arn:aws:appconfig:*:ACCOUNT-ID:application/*/environment/*",
                "arn:aws:appconfig:*:ACCOUNT-ID:application/*/configurationprofile/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/environment": "dev"
                }
            }
        }
    ]
}