Hi all, I'm creating a service account where I need certain permissions set to allow my compute engine instance to be able to write to a storage bucket. In order to do that, I figured I'd need to create a custom role and assign that to the service account. So far I've got:

const org = gcp.organizations.getOrganization({
  domain: "my-org-name",
});

const myRole = new gcp.organizations.IAMCustomRole("role-xyz", {
  description: "xyz",
  orgId: org.then(o => o.orgId),
  permissions: [
    "storage.objects.create",
    "storage.objects.delete",
    "storage.objects.get",
    "storage.objects.list",
    "storage.objects.update",
  ],
  roleId: "my-role-id",
  title: "My New Role",
});

When I

pulumi up

I get the following error:

* Unable to verify whether custom org role organizations/<my-org-id>/roles/my-role-id already exists and must be undeleted: Error when reading or editing Custom Organization Role "organizations/<my-org-id>/roles/my-role-id": googleapi: Error 400: The role name must be in the form "roles/{role}", "organizations/{organization_id}/roles/{role}", or "projects/{project_id}/roles/{role}"., badRequest

Any idea what's happening? The error message contains the correct org id, and I've checked in GCP Console and no role has been created. Thanks for your help!