Greengrass own component deployment stuck "in progress"

I'm trying to deploy my own GreengrassV2 components. It's a SageMaker ML model (optimized with SageMakerNeo and packaged as a Greengrass component) and the according inference app. I was trying to deploy it to my core device with SageMaker Edge Manager component. But it is always stuck in the status "In progress".

My logs show this error: com.aws.greengrass.tes.CredentialRequestHandler: Error in retrieving AwsCredentials from TES. {iotCredentialsPath=/role-aliases/edgedevicerolealias/credentials, credentialData=TES responded with status code: 403. Caching response. {"message":"Access Denied"}}

But how do I know which policies are missing?