What is the appropriate aws iot provisioning by claim policy?

I recently started having an issue with provisioning devices. I had previously been using the following policy definition, for quite some time:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "iot:Connect",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:[location:id]:topic/$aws/certificates/create/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Publish",
      "Resource": "arn:aws:iot:[location:id]:topic/$aws/provisioning-templates/birthing_template/provision/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": "arn:aws:iot:[location:id]:topic/$aws/certificates/create/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Receive",
      "Resource": "arn:aws:iot:[location:id]:topic/$aws/provisioning-templates/birthing_template/provision/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "arn:aws:iot:[location:id]:topic/$aws/certificates/create/*"
    },
    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "arn:aws:iot:[location:id]:topic/$aws/provisioning-templates/birthing_template/provision/*"
    }
  ]
}

However, recently devices started to fail when provisioning. Looking at the Cloudwatch logs I would get something like:

{
    "timestamp": "2024-02-14 17:02:02.503",
    "logLevel": "ERROR",
    "traceId": "2aeeb77f-7f45-7e3b-f2dc-d5893ed5d48d",
    "accountId": "ACCOUNTID",
    "status": "Failure",
    "eventType": "Subscribe",
    "protocol": "MQTT",
    "topicName": "$aws/provisioning-templates/birthing_template/provision/json/rejected",
    "clientId": "CLIENTID",
    "principalId": "PRINCIPALID",
    "sourceIp": "SOURCEIP",
    "sourcePort": 61801,
    "reason": "AUTHORIZATION_FAILURE",
    "details": "Authorization Failure"
}

I then changed:

    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "arn:aws:iot:[location:id]:topic/$aws/provisioning-templates/birthing_template/provision/*"
    }

to:

    {
      "Effect": "Allow",
      "Action": "iot:Subscribe",
      "Resource": "*"
    }

And it started working. Is there something I'm missing? How is it that the previous template was working before?