I'm not sure I understand what happened inside AWS. We've been running the sync this way for ages, and it's fine. But suddenly we need delete permission? Seems a little weird. I kinda assume some version updated and now we do. I started by trying to modernize the sync to use OIDC credentials instead of the API key. But I couldn't get that working. So I just fixed the API key permissions. I'd like to revisit that, since it's a clear place to improve.