aws:RequestTag on s3 bucket is not working (while assuming a role)

Question

i have the following policy on an IAM role which i'm assuming into:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::mybucket/${aws:RequestTag/personalid}/*"
        }
    ]
}

When performing assume role, i'm passing the tag:

response = sts_client.assume_role(
       RoleArn=arn,
       RoleSessionName=role_session_name,
       Tags=[
          {
             'Key': 'personalid',
             'Value':'a'
          },
       ])

but i get access denied when trying to read an object under folder 'a':

    s3 = boto3.resource(
      's3',
      aws_access_key_id=response['Credentials']['AccessKeyId'],
      aws_secret_access_key=response['Credentials']['SecretAccessKey'],
      aws_session_token=response['Credentials']['SessionToken'],
      region_name=client_main_region
   )
    obj = s3.Object('mybucket', f'a/file.txt')
    print(obj.get()['Body'].read().decode('utf-8'))

I've replaced the policy with "principalTag", while adding a tag to the role, and it works - what am i doing wrong?

=====

Another thing i tried, is to tag the s3 object with that ID, and with the following policy:

{
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:GetObject"
            ],
            "Condition": {
                "StringEqualsIfExists": {
                    "aws:RequestTag/personalid": "${s3:ExistingObjectTag/personalid}"
                }
            },
            "Resource": "arn:aws:s3:::mybucket/*"
        }

Not working

Answer 1

If anyone ever looks for this - apparently the trust relationship should declare those tags - so they will be available:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123:role/lambda_role"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123:role/lambda_role"
      },
      "Action": "sts:TagSession",
      "Condition": {
        "StringLike": {
          "aws:RequestTag/personalid": "*"
        }
      }
    }
  ]
}

Then, i could use this tag as principal tag in the assumed role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::mybucket/${aws:PrincipalTag/personalid}/*"
        }
    ]
}