Amazon web services – IAM role to pull image from a private AWS ECR registry based on image tag

I am trying to put together an IAM role to allow pulling an image from ECR. I want to control access to the image using a specific tag (Image tag not AWS resource tag). So far, it seems that AWS only allows attribute-based access control to the ECR repository itself.

Moving the images of interest to a new repo and giving access to that seems like the only option, but I am really trying to avoid that. Any ideas?

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ecr:GetAuthorizationToken"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability",
                "ecr:GetDownloadUrlForLayer"
            ],
            "Resource": "arn:aws:ecr:XXXX:XXXX:repository/XXXX",
            "Condition": {
                "StringEquals": {
                    ...
                }
            }
        }
    ]
}