I recall that there was at least one case where two similar condition keys that by name should work both, only one was appropriate.

But then I actually blew the stack in IAM processing to the point we couldn't start an AWS sagemaker notebook because IAM died while attaching a network interface to EC2...