In my experience, it's fine. I just wish it supported more condition keys across all services. Nothing sucks more than to write a policy with a explicit condition only to bash your head trying to figure out why and then finally realize that restricting for a specific tag for a specific resource+action is not supported.