Grant access for IAM policy to specific AWS Lightsail resources using tags

I'm trying to create an IAM policy so that the user can access Lightsail but only have access to specified instances. Ideally it would use tags so it's easy to maintain, but specifying individual instances would be fine.

I've tried various things, but they either make all instances disappear for the user (when logged in as the user to the web console), or leave all instances visible.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "lightsail:*",
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Deny",
            "Action": "lightsail:*",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/wordpress": "true"
                }
            }
        }
    ]
}

And

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "FullAccess",
            "Effect": "Allow",
            "Action": ["lightsail:*"],
            "Resource": ["*"]
        },
        {
            "Sid": "DenyInstance",
            "Action": ["lightsail:*"],
            "Effect": "Deny",
            "Resource": ["arn:aws:lightsail:us-east-1:861111111111:Instance/11111111-1b1b-1b1b-1b1b-11bb11bb1b1b"]
        }
    ]
}