Comment 1 for bug 1809348

I wound up editing the permission we gave it by binding a custom role that granted the specific IAM permission it was seeking and that seems to have resolved the inconsistencies for now.

I'd advocate we get at least those bare minimum role assumptions spelled out so we can create a "one shot" role that it needs to self bootstrap. otherwise it works as advertised.