passrole-conditionals.json

{
    "Effect": "Allow",
    "Action": "iam:PassRole",
    "Resource": "*",
    "Condition": {
        "StringEquals": {
          "iam:PassedToService": "ec2.amazonaws.com"
        },
        "StringLike": {
            "iam:AssociatedResourceARN": [
                "arn:aws:ec2:us-east-1:123456789012:instance/*",
                "arn:aws:ec2:us-west-1:123456789012:instance/*"
            ]
        }
    }
}