Policy to restrict command and instance combinations

Hi,

we are looking at moving away from Rundeck to AWS Systems Manager, but we do not see how to restrict certain commands to certain instances. For example, in Rundeck we can allow Command1 to be sent to instances A or B and Command2 to be sent to instances B or C (but not A).

We tried something like this in SSM, but the policies end up being additive and commands 1 & 2 can be executed on A, B, or C:

{
            "Action": [
                "ssm:SendCommand"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:ec2:ca-central-1:*:instance/InstanceA",
                "arn:aws:ec2:ca-central-1:*:instance/InstanceB",
                "arn:aws:ssm:ca-central-1:*:document/Command1"
            ]
        },
{
            "Action": [
                "ssm:SendCommand"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:ec2:ca-central-1:*:instance/InstanceB",
                "arn:aws:ec2:ca-central-1:*:instance/InstanceC",
                "arn:aws:ssm:ca-central-1:*:document/Command2"
            ]
        },

We then tried with conditions based on resource tag, but we can only filter instances OR commands, but not both at the same time.

Any tip on how to do this?

Regards,
Bart