How to allow only specific OpenID Connect provider in AWS with AWS SCP?

Question

I'm trying to limit the possibility of adding new providers to an AWS account. I'm also using Bitbucket to deploy my app via Bitbucket Pipelines and I use OpenID Connect as a secure way for the deployments.

Now I have created a SCP to deny creation/deletion of IAM user and adding/deletion of providers. In this SCP I want to make an exception, it the URL for the IDP is a specific one, it should be allowed in all accounts to create or delete this provider.

Thing is, I don't understand, why my condition is not working. Any hints?

Thx!

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Deny",
      "Action": [
        "iam:CreateGroup",
        "iam:CreateLoginProfile",
        "iam:CreateOpenIDConnectProvider",
        "iam:CreateSAMLProvider",
        "iam:CreateUser",
        "iam:DeleteAccountPasswordPolicy",
        "iam:DeleteSAMLProvider",
        "iam:UpdateSAMLProvider"
      ],
      "Resource": [
        "*"
      ],
      "Condition": {
        "StringNotEquals": {
          "iam:OpenIDConnectProviderUrl": [
            "https://api.bitbucket.org/2.0/workspaces/my-workspace-name/pipelines-config/identity/oidc"
          ]
        }
      }
    }
  ]
}