Allow iam:UpdateUser only on resource that has a specific tag

Having the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iam:*",
      "Resource": "*",
      "Condition": {
        "StringEquals": { "aws:ResourceTag/foo": "bar" }
      }
    }
  ]
}

I am able to successfully perform iam:CreateUser and iam:DeleteUser on a resource which has the tag "foo": "bar". Unfortunately, I am unable to perform iam:UpdateUser on the same resource:

Error updating IAM User <user_name>: AccessDenied: User: <user_arn> is not authorized to perform: iam:UpdateUser on resource: <user_arn>

What I'm looking for is a way to create a policy that allows read/write access only to resources with specific tag key-value pair. But at this point I feel I'm approaching this wrong.