How to troubleshoot "The role provided is unauthorized to perform the required action" when adding VPC connection to QuickSight

Go to CloudTrail, look up CreateVPCConnection event around the time of the failed "Add VPC connection" attempt. The message will likely have "AccessDenied" error code. Look up errorMessage. In my case it was "Not allowed to perform operation: describeSubnets" Turns out I missed a step to grant describeSubnets permission to the execution role that I selected on the "Add VPC Connection" form. I resolved it by going to IAM and adding the required permissions to the execution role. Required permissions are specified in the "Prerequisites" section at https://docs.aws.amazon.com/quicksight/latest/user/vpc-creating-a-connection-in-quicksight-console.html