I fixed the permissions issue by making myself the owner of my organisation. Not sure what the role would include the relevant IAM permissions, but it's just me working on it, so no concerns there.

An update on Service Account permissions for anyone watching. My understanding of roles, permissions and access to resources wasn't quite right. Instead of adding a role to the service account, I ended up granting access via resource policies to allow the service account access to the things it needs. Code looks like this:

const policyTopic = new gcp.pubsub.TopicIAMMember("policy-topic-abc", {
  member: emailOfServiceAcct,
  topic: myTopic.name,
  role: "roles/pubsub.publisher",
});

const policyBucket = new gcp.storage.BucketIAMMember("policy-bucket-abc", {
  member: emailOfServiceAcct,
  bucket: myBucket.name,
  role: "roles/storage.admin",
});