IIRC, you can, but it's bit elliptical: because IAM access policies can key off tags, you can adopt an IAM role that can only see the desired tags, and list objects.

Ah hah - but see https://medium.com/zendesk-engineering/resurrecting-amazon-s...