AWS IAM Permission Boundaries and iam:PassROle

I want to create a IAM Role "deploy" in AWS, that is able to deploy lambda functions. The Role is supposed to create everything needed for the lambda functions, including the Execution Role.

So the "deploy" Role must be able to create Roles and add policies. To prevent permission Escalation, I thought permission boundaries would be a good Idea. So I would create a permission boundary policy, and prevent the "deploy" Role to create any Role without that permission boundary.

How that is done is described here. Basically, any CreateRole action, that does not use the permission boundary, is denied. And any temparing with the permission boundary is also denied. This works by setting a condition like this (for details see the provided link):

"Condition": {
  "StringEquals": {
    "iam:PermissionsBoundary": "arn:aws:iam::123456789012:policy/MyPermissionBoundary"
    }
  }
}

But for my use case, what it comes down to preventing the "deploy" Role from using iam:Pass with any Role, that has not have the permission boundary set. Otherwise the "deploy" Role could pass an Admin Role to the lambda function.

But as fas as I can see, I cannot set the "iam:PermissionsBoundary" condition for iam:PassRole.

Am I overseeing something? How can I get this to work?