title: AWS Policy Restrict Permission Based On Service
body: <p>I need to provide IAM role creation permission to a user but with a condition that if he does it only from some AWS service.
  For example, if a user running cloudformation stack and attempting to create an IAM role, he should be allowed. if he manually creating role it should be denied. or if a person creating a codepipeline he should have permission to create the role.</p>