Scenario: Restrict access to the NAT gateway only through the IAM role sso-admin.
Policy example:

{ 
  "Statement": [ 
    { 
      "Effect": "Allow", 
      "Action": [ 
        "natgateway:*" 
      ], 
      "Resource": [ 
        "*" 
      ], 
      "Condition":{ 
          "StringEquals":{ 
                  "volc:PrincipalTrn":"trn:iam::20000123**:role/sso-admin" 
          } 
      } 
    } 
  ] 
}

For details of the condition key, please refer to the Condition Use Instructions