IAM policy not taking effect

[JamesD09]

Hi folks, 

I am looking to lock down the ability to view logs from a certain host group with the following IAM policy:
"ALLOW storage:logs:read WHERE storage:dt.host_group.id = "Hostgroup2";"

In theory this should lock down my user to only be able to view logs for logs written by hosts in "Hostgroup2" HOWEVER when applying the policy my user is still able to see logs written by all host groups. 

Is anyone able to advise? i have followed the syntax and conditions defined in the IAM service reference documentation.

[JamesD09]

You can see from the Policy review below the condition is set but does not take effect:

[GerardJ]

Hi @JamesD09 

have you checked with the "effective policies" tool whether there isn't another access right that would extend this policy and make this limitation ineffective?
You also have to check that no RBAC permission gives the user more rights over logs than you'd expect.