I have a keyring and key in Google Cloud KMS. I want to use the key to encrypt a secrets.yml file using helm secrets enc

I am the GCP project owner, and I have also given myself the specific encrypt/decrypt IAM role, which I don't think is needed, given I am the owner, but worth a try a thought.

I'm getting the following permission denied error when trying to run helm secrets enc secrets.yml:

Could not generate data key: [failed to encrypt new data key with master key "projects/myproject-266813/locations/global/keyRings/myKeyRing/cryptoKeys/myKey": Failed to call GCP KMS encryption service: googleapi: Error 403: Permission 'cloudkms.cryptoKeyVersions.useToEncrypt' denied on resource 'projects/myproject-266813/locations/global/keyRings/myKeyRing/cryptoKeys/myKey' (or it may not exist)., forbidden]

My .sops.yml file:

creation_rules: - gcp_kms: projects/mirkwood-266813/locations/global/keyRings/lotr/cryptoKeys/cdlkey

I am authenticated with the correct gcp account, so what am I missing?