My config is not working... Legal Hold S3 Export Fails with 403

Can’t get this config to load properly… We are attempting to push digital channel transcripts to an external S3 bucket for legal discovery. The bulk export job initiates but fails immediately with a 403 Forbidden error on the upload step. Our IAM role has full access. Here is the export configuration:

export:
 type: s3
 bucket: legal-hold-archive
 region: eu-west-2
 metadata: true

Is there a specific policy requirement for the Genesys Cloud service account we are missing?