Custom IAM policy

Hi Community,

assume we have the following policy for an IAM user

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:GetUser",
                "iam:CreateUser",
                "iam:CreateAccessKey"
            ],
            "Resource": "arn:aws:iam::*:user/iot.*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "iam:AddUserToGroup",
            "Resource": "arn:aws:iam::*:group/CUSTOMGROUP"
        }
    ]
}

He should now be able to perform GetUser, CreateUser and CreateAccessKey for all IAM users starting with iot. Second rule should allow him to add IAM user to the Group CUSTOMGROUP

Everything works fine, but I want that the user is only allowed to add other IAM users starting with iot. to the group CUSTOMGROUP How can this be achieved? I was thinking about adding something like

"Condition": {"StringLike": {"iam:user": ["iot.*"]}}

This does not work... any idea if this is possible at all?