title: Restrict IAM Role to be attached to an EC2 instance if Instance Id does not match the one in IAM Policy
body: <p>I am trying to create IAM Policy which restricts passing the IAM Role to an EC2 instance that if instance id does not equal to <code>i-1234567890abcd</code></p>
  
  <p>There is no error in the policy but there is no effect of this policy either. If I remove <code>Condition</code> from the below policy, it works but it restricts the role to be attached to any EC2 instance.</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Deny",
        "Action": ["iam:PassRole"],
        "Resource": ["arn:aws:iam::000000000000:role/MyEC2InstanceSpecificRole"],
        "Condition": {
          "ArnNotEquals": {
            "ec2:SourceInstanceARN": "arn:aws:ec2:us-east-1:000000000000:instance/i-1234567890abcd"
          }
        }
      }
    ]
  }
  </code></pre>