AWS cognito identity pool ABAC how to map custom multi-valued attributes?

Example open id token from the identity provider (Cognito user pool in this example):

{
  "cognito:groups": [
    "testers",
    "admins",
  ],
  "email_verified": false,
  ...
}

I want to use ABAC, like the example given here: https://docs.aws.amazon.com/cognito/latest/developerguide/using-attributes-for-access-control-policy-example.html

So that I can add policy statements to the role associated with the Cognito identity pool with conditions, example:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "rds-db:connect",
            "Resource": "arn:aws:rds-db:eu-west-1:123456789012:dbuser:cluster-teapot/db-user",
            "Effect": "Allow",
            "Condition": {
                "ForAnyValue:StringLike": {
                    "aws:PrincipalTag/groups": "admins"
                }
            }
        }
    ]
}

It works like a charm if you use single valued custom claims, like the "email_verified" above, but if I try to map array-valued claims like "cognito:groups"

aws cognito-identity get-credentials-for-identity...

fails with: Invalid identity pool configuration. Check assigned IAM roles for this pool.

This is not a problem with trust since its tried and tested with single-valued claims, so I am wondering if someone knows if the syntax is wrong, or if this is a missing feature?