Repository: aws-cloudformation/cfn-lint

Issue:
I3510 - False positives for missing resources for ec2:CreateTags
### CloudFormation Lint Version

1.31.1

### What operating system are you using?

Fedora

### Describe the bug

The ec2:CreateTags IAM permission accepts multiple resource types.

The I3510 appears to be enforcing that every potential resource type is listed

To recreate run

cfn-lint -c I <path/to/reproduce-template.yml>

### Expected behavior

No errors from cfn-lint

### Reproduction template

```yaml
Resources:
    Role:
        Type: AWS::IAM::Role
        Properties:
            RoleName: EC2ImageBuilderDistributionCrossAccountRole
            AssumeRolePolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: Allow
                    Principal: {AWS: [arn:aws:iam::123456789123:root]}
                    Action: ['sts:AssumeRole']
            Path: /
            ManagedPolicyArns:
              - !Sub "arn:${AWS::Partition}:iam::aws:policy/Ec2ImageBuilderCrossAccountDistributionAccess"
            Policies:
                - PolicyName: ec2snapwrite
                  PolicyDocument:
                    Version: '2012-10-17'
                    Statement:
                        - Effect: Allow
                          Action:
                             - ec2:CreateTags
                          Resource: 'arn:aws:ec2:*::snapshot/*'
                          Condition:
                              StringEquals:
                                  "aws:RequestedRegion": !Ref AWS::Region
```


Discussion:

Patch:
diff --git a/src/cfnlint/rules/resources/iam/StatementResources.py b/src/cfnlint/rules/resources/iam/StatementResources.py
index c64216d71f..1f16baa01b 100644
--- a/src/cfnlint/rules/resources/iam/StatementResources.py
+++ b/src/cfnlint/rules/resources/iam/StatementResources.py
@@ -158,15 +158,17 @@ def validate(
                         ].get("ARNFormats")
                         for arn_format in arn_formats:
                             arn = _Arn(arn_format)
-                            if arn not in all_resource_arns:
-                                yield ValidationError(
-                                    (
-                                        f"action {action!r} requires "
-                                        f"a resource of {arn_formats!r}"
-                                    ),
-                                    path=deque(["Resource"]),
-                                    rule=self,
-                                )
+                        if arn in all_resource_arns:
+                            break
+                    else:
+                        yield ValidationError(
+                            (
+                                f"action {action!r} requires "
+                                f"a resource of {arn_formats!r}"
+                            ),
+                            path=deque(["Resource"]),
+                            rule=self,
+                        )
                 else:
                     LOGGER.debug(f"action {action!r} requires a resource of '*'")
                     # yield ValidationError(


Test patch:
diff --git a/test/unit/rules/resources/iam/test_statement_resources.py b/test/unit/rules/resources/iam/test_statement_resources.py
index a25d77ee92..64c57f0097 100644
--- a/test/unit/rules/resources/iam/test_statement_resources.py
+++ b/test/unit/rules/resources/iam/test_statement_resources.py
@@ -112,6 +112,13 @@ def template():
             },
             [],
         ),
+        (
+            {
+                "Action": "ec2:CreateTags",
+                "Resource": ["arn:aws:ec2:*::snapshot/*"],
+            },
+            [],
+        ),
         (
             {
                 "Action": "cloudformation:CreateStackSet",