[ldoughty]

That's the root of my complaint...

This effectively means IAM cannot limit creation events by tag because it's two steps. Only solution is two steps