AWS IAM Policy to only list instances based on EC2 tag

I created an IAM Role with the following Permissions policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "ec2:DescribeInstances",
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/Project": "Phoenix"
                }
            }        
        }
    ]
}

A 3rd party App uses the Role ARN associated with the IAM Policy to describe EC2 instances. The objective is for the App to only be allowed describing EC2 instances tagged Project=Phoenix. The issue is the App gets an error "AWS credentials have insufficient permission to perform action" so no EC2 are described at all. There are 2 instances with the matching tag.

If I remove the Condition from the policy, DescribeInstances works but the App gets all EC2 from any specified AWS Region. I need to limit the list of EC2 returned to only instances tagged Project=Phoenix.

Also tried tagging the IAM Role with Project=Phoenix as a test but same error.

Am I using & configuring the IAM Role and Policy correctly for the objective? What do I need to adjust?

EDIT: Instead of EC2 tags, I tried limiting scope based on subnet association

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:StartInstances",
                "ec2:StopInstances",
                "ec2:TerminateInstances"
            ],
            "Resource": "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-00bc6a6522a37z348"
        }
    ]
}

Access level=None / Resource=None / Request condition=None

"This policy defines some actions, resources, or conditions that do not provide permissions. To grant access, policies must have an action that has an applicable resource or condition."