Denying the ability to create a specific tag key in EC2

Question

Currently in my environment, we can restrict user access to a EC2 resource by tagging it with a tag key value of "lock_down". However I'd like to create a IAM policy that prevents users from tagging resources with the tag key "lock_down" and restrict it to the admin role only.

I've tried something like

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Deny",
        "Action": "ec2:CreateTags",
        "Resource": "*",
        "Condition": {"ForAllValues:StringEquals": {"aws:TagKeys": ["lock_down"]}},
         {"StringNotLike":{"aws:PrincipalARN":"aws:iam::*:role/admin"}}
    }]
}

But seems like it doesn't care about that Key condition at all...any tips?