I have a case when I need to create a set of permissions for a group and the permissions are comprised of both managed and an inline policy. The group should have the ViewOnlyAccess and AmazonInspector2ReadOnlyAccess managed policies. And an inline policy

{
"Version" : "2012-10-17",
"Statement" : [
{
"Effect" : "Allow",
"Action" : [
"a4b:Get*",
"account:Get*",
"glue:GetConnections",
"securityhub:BatchImportFindings",
"ssm-incidents:List*",
"wellarchitected:List*"
],
"Resource" : "*"
}
]
}

But I want these permissions to provide access to a single vpc. How do I achieve that?

I tried writing a policy specifically for the targeted vpc but that did not work?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:Vpc": "vpc-xxxx"
        }
      }
    }
}

Also, since not everything is tied to the vpc, is it better to write a policy that targets the resource tags?