Figured it out, for anyone who sees this, I was using

IAMBinding

and I should have been using

IAMMember

.

IAMBinding

sets the entire project membership for the named role, which is very surprising as someone familiar with k8s `rolebinding`s