title: AWS Parameter Store IAM policies are not working correctly
body: <p>I need some help related to creating AWS policies.</p>
  <p>I need a policy linked to an EC2 instance to be able to give only a <code>get-parameters-by-path</code> to a specific parameter in AWS SSM parameter store, without being able to change anything like <code>Delete</code>, <code>Create</code>, etc and should only be able to get the values.</p>
  <p>This policy specificity will be given through tags.</p>
  <p>Here's my policy I'm trying to use:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [&quot;ssm:*&quot;],
              &quot;Resource&quot;: [&quot;*&quot;]
          },
          {
              &quot;Effect&quot;: &quot;Deny&quot;,
              &quot;Action&quot;: [
                 &quot;ssm:PutParameter&quot;,
                 &quot;ssm:GetParameter&quot;,
                 &quot;ssm:GetParameters&quot;,
                 &quot;ssm:DeleteParameter&quot;,
                 &quot;ssm:GetParameterHistory&quot;,
                 &quot;ssm:DeleteParameters&quot;,
                 &quot;ssm:GetParametersByPath&quot;
               ],
              &quot;Resource&quot;: [&quot;*&quot;],
              &quot;Condition&quot;: {
                  &quot;StringNotEquals&quot;: {
                      &quot;ssm:resourceTag/env&quot;: &quot;development-1&quot;
                  }
              }
          }
      ]
  }
  </code></pre>
  <p>Using the <a href="https://policysim.aws.amazon.com/" rel="nofollow noreferrer">AWS Policy Simulator</a> it informs you that when trying to <code>View</code>, <code>Create</code>, <code>Modify</code>, <code>Delete</code> Parameters with <code>&quot;ssm:resourceTag/env&quot;: &quot;development-2&quot;</code> a denial message is informed, while other projects with <code>&quot;ssm:resourceTag/env&quot;: &quot;development-1&quot;</code> it is possible to modify, view, etc.</p>
  <p>However, when tying the same policy to an EC2 instance, the policy blocks any of the actions added in Deny.</p>
  <p><strong>EC2 Informed Messages</strong>:</p>
  <p><code>/development-1/project-1</code></p>
  <pre><code>aws --region us-east-2 ssm get-parameters-by-path --path /development-1/project-1/ --recursive --with-decryption --output text --query &quot;Parameters[].[Value]&quot;
  
  An error occurred (AccessDeniedException) when calling the GetParametersByPath operation: User: arn:aws:sts::111111111:assumed-role/rule-ec2/i-11111111111 is not authorized to perform: ssm:GetParametersByPath on resource: arn:aws:ssm:us-east-2:11111111111:parameter/development-1/project-1/ with an explicit deny
  </code></pre>
  <p><code>/development-2/project-2</code></p>
  <pre><code>aws --region us-east-2 ssm get-parameters-by-path --path /development-2/project-2/ --recursive --with-decryption --output text --query &quot;Parameters[].[Value]&quot;
      
  An error occurred (AccessDeniedException) when calling the GetParametersByPath operation: User: arn:aws:sts::11111111111:assumed-role/rule-ec2/i-11111111111 is not authorized to perform: ssm:GetParametersByPath on resource: arn:aws:ssm:us-east-2:11111111111:parameter/development-2/project-2/ with an explicit deny
  </code></pre>
  <p>Tags used:</p>
  <p>key=value</p>
  <p><code>/development-1/project-1</code>:</p>
  <p>env=development-1</p>
  <p><code>/development-2/project-2</code>:</p>
  <p>env=development-2</p>
  <p>What am I doing wrong?</p>