unable to delegate ec2 instance management to group (IAM Policy)

we need to delegate management of several instances through AWS console to one of our clients. For this purpose we created a new IAM group.

We need this group to only list and modify specific EC2 instances, e.g. using a tag. We tried using the read-only ec2 template, and modifying it by adding:

  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:Describe*",
      "Resource": "*",
      "Condition": {
         "StringEquals": {
            "ec2:ResourceTag/Tenant": "clientname"
         }
      }      
    },...

This unfortunately results to "You are not authorized to describe Running Instances" for the aws console, and no instances are shown, although the correct tag exists. Please advise on how can we filter instance listing based on tags or other methods (e.g. VPC id).