ABAC for list or read resources.

Hi, In my organization we are using SAML-based identity provider (IdP) to manage corporate user identities, in a way that these users take on a federated role. We are trying to apply ABAC for these roles, so that roles only have permissions to resources with the same label as the role. However, I am having problem with some permissions, for example, I have noticed that I cannot apply ABAC for only list certain EC2 instances or S3 bucket.

{
    "Effect": "Allow",
    "Action": [
      "s3:DeleteObject",
      "s3:Get*",
      "s3:List*",
      "s3:PutObject"
    ],
    "Resource": "*",
    "Condition": {
      "StringEquals": {
        "aws:ResourceTag/Example": "${aws:PrincipalTag/Example}"
      }
    }
}

For example with the above policy, even if I just include "s3:*", I get the following message through the console.

S3 is only example, but I have the same problem for the rest of services, EC2, RDS.... Even through aws cli, I cannot list any resources.

When, I attach the predefined AWS "ReadOnlyAccess" policy in addition to the other policy. I am able to list all the resources, but I no longer have the expected granularity, so I guess there are policies that don't work with ABAC like s3:ListAllMyBuckets but they are not very clear at https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html

Am I right? Or is there any way to apply ABAC for reading with this granularity ?

For other actions such as Starting and Stopping EC2 instances, it works fine.