Enforce IOT policy with Thing attributes - client disconnects

I have a thing connected to AWS IoT and sending messages with no problems, my policy looks like this

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iot:Connect",
        "iot:Subscribe"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iot:Receive",
        "iot:Publish"
      ],
      "Resource": [
        "arn:aws:iot:eu-central-1:574787835894:topic/FOO/*"
      ]
    }
  ]
}

My thing is using a type with a searchable attribute called "prefix"
Type is properly attached to the thing
Attribute key is properly filled with "prefix" and its value with "FOO"
However, when I update the policy to use searchable attributes in this way client disconnects with AUTH failure:

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "iot:Connect",
            "iot:Subscribe"
          ],
          "Resource": "*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "iot:Receive",
            "iot:Publish"
          ],
          "Resource": [
            "arn:aws:iot:eu-central-1:574787835894:topic/${iot:Connection.Thing.Attributes[prefix]}/*"
          ]
        }
      ]
    }

I have spent a lot of hours to debug this problem without success, please, any idea?