I need an S3 bucket that blocks write actions when a tag indicates that bucket should not be writeable. I think this terraform should make a bucket that checks the bucket’s tag but I get policy error

provider "aws" {
  region = "us-east-1"
}

resource "aws_s3_bucket" "foo_cooke_bucket" {
  bucket = "foo-cooke-bucket"

  tags = {
    writable = "true"
  }
}


resource "aws_s3_bucket_policy" "bucket_policy" {
  bucket = aws_s3_bucket.foo_cooke_bucket.id

  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect   = "Deny",
        Principal = "*",
        Action   = "s3:PutObject",
        Resource = ["${aws_s3_bucket.foo_cooke_bucket.arn}/*","${aws_s3_bucket.foo_cooke_bucket.arn}"],
        Condition = {
          StringEquals = {
            "s3:ExistingObjectTag/writable" = "false"
          }
        }
      },
      {
        Effect   = "Deny",
        Principal = "*",
        Action   = "s3:DeleteObject",
        Resource = ["${aws_s3_bucket.foo_cooke_bucket.arn}/*","${aws_s3_bucket.foo_cooke_bucket.arn}"],
        Condition = {
          StringEquals = {
            "s3:ExistingObjectTag/writable" = "false"
          }
        }
      }
    ]
  })
}

I get

api error MalformedPolicy: Conditions do not apply to combination of actions and resources in statement