I am trying to create SCP that blocks public C3 buckets which I find the solution using:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "s3:PutBucketPublicAccessBlock",
        "s3:PutAccountPublicAccessBlock"
      ],
      "Resource": "*",
    }
  ]
}

However, I am unable to find solution where I can allow certain buckets to be public if they have Bucket Tag: key1:value1