AWS::SQS::Queue - Tagging-OnCreate

## Scope of request

AWS::EC2::SecurityGroup - when I have an IAM deny statement to create an SQS Queue without a specifig tag (aws:RequestTags), I can create resource via API, but not via CloudFormation.

## Expected behavior

When I create a SQS Queue with an IAM policy to enforce tagging, I should be able to create the resource through API or CloudFormation the same way.
So far :
- Creating through API/GUI works
- Creating through CloudFormation does not work

## Suggest specific test cases

### Prerequisites

IAM deny policy should be as follow :

```
- Effect: "Deny"
Action:
- "sqs:CreateQueue"
Resource:
- "arn:aws:sqs:*:*:*"
Condition:
"StringNotLike":
"aws:RequestTag/project":
- "?*"

```
User should use the Administrator Policy.

### Test case success

CFN Template should be just creating a SQS Queue with the tag "project" set to any value with 1 or more character.
When running, the template should be successful.

### Test case failure

CFN Template should be just creating a SQS Queue with no tag "project" set.
When running, the template should be failing because of a lack of rights.

## Category

Integration SQS

Start by reproducing the issue with an AWS::SQS::Queue CloudFormation template and the supplied IAM deny policy. Compare creation with and without the project tag, using the API/GUI behavior as the reference. Done means tagged queues succeed through CloudFormation and untagged queues fail for lack of rights.

Written by the indexing model from the issue text.