AWS IAM policy based on PermissionSet mapping

Question

How can I create AWS SCP conditions which restrict the scope of the policy only to AzureAD users which are members of AD group associated with a specific PermissionSet?

For example, let's assume I have AD user [email protected], member of "NoEC2Access" AD Group. This AD Group is mapped to "noEC2" PermissionSet.

I want to create and SCP, to be applied to some OUs, that will deny all the "ec2:*" actions to all users that are members of a group which has "noEC2" PermissionSet mapped to it.

{
   "Version": "2012-10-17",
   "Statement": [
      {
        "Effect": "Deny",
        "Action": ["ec2:*"],
        "Resource": "*"
      },
      "Condition": {
            <HERE THE CONDITION>
      }
    ]
}

Thanks