Access Denied Exception when using CreateDataSourceCommand

Howdy,

I've got a pretty frustrating issue I can't solve. I'm trying to use the SDK to:

1. Create an S3 bucket for a user (success!)
2. Create an S3 vector database for a user (success!)
3. Create a knowledge base for a user using the S3 vector database (success!)
4. Use the S3 bucket in step one as the datasource for the knowledge base (failure)

When I get to step 4, the error is some flavor of: 'User: arn:aws:iam::<account_id>:user/test-bedrock is not authorized to perform: bedrock:CreateDataSource', even though that user has performed steps 1 through 3 with the correct permissions.

What I've tried:

1. Confirm that I can use the programatically generated bucket, s3 vector database, and knowledgebase by using the Web Interface to manually create and add a data source to the knowledgebase.
2. Ensuring that permissions are correct. The user has full S3 and Bedrock permissions. I have confirmed in the IAM policy simulation that the user has bedrock:CreateDataSource permission.
3. When I create the knowledgebase, it is using a role called BedrockAgentRole. I've confirmed that this role also has full access, and that the user test-bedrock can correctly assume the role of BedrockAgentRole, which is required for creating the Knowledge Base in step 2. Both seem to have full S3 and Bedrock access, at least to perform steps 1 through 3 above.
4. Switched credentials to the service role that created the knowledge base to see if that works, the error in that case is `'User: arn:aws:sts::<account_id>:assumed-role/BedrockAgentRole/AWSPlaygroundSession is not authorized to perform: bedrock:CreateDataSource'. Again, both the user and role appear to have full S3 and Bedrock permissions.

My code to create the Data Source programmatically is:

    try{
      response = await bedrockClient.send(new CreateDataSourceCommand({
        knowledgeBaseId: `kb-${user.id}`,
        name: `ds-${user.id}`,
        dataSourceConfiguration: {
          type: "S3",
          s3Configuration: {
            bucketArn: `arn:aws:s3:::${process.env.PRIVATE_AWS_S3_BUCKET}`,
            inclusionPrefixes: [
              `kb/${user.id}/`
            ]
          },    
        }
      }));
      console.log('Data source created:', response.$metadata);
    } catch(e) {
      console.error("Error creating data source:", e);
      throw e;
    }