Aha, thanks.
It turns out that the IAM policy was missing a couple of things that are now required. Working great now.