In my AWS account we have 3 different applications, A, B, C.
I want to create an IAM policy for the B team that allows them to create new EC2 instances, but limit it to be tagged within the B resource group, or some other constraint that can definitively associate that new instance with the B group. Is that possible?