What are the correct permissions to give Argo workflows given googleapi: Error 403?

Question

I am seeing the following error running Argo workflows in GKE.

time="2022-05-13T14:17:40.740Z" level=info msg="node changed" new.message="Error (exit code 1): upload /tmp/argo/outputs/artifacts/message.tgz: writer close: googleapi: Error 403: Access denied., forbidden" new.phase=Error new.progress=0/1 nodeID=hello-world-3126142299 old.message= old.phase=Pending old.progress=0/1

I am using a permission set that worked once. I think - I used to be able to run this workflow, but it has been a while. When I first ran the workflow, it gave me an error saying something like "you are using a deprecated permissions, look here (https://argoproj.github.io/argo-workflows/workflow-rbac/)." I updated to the below set and now am getting the above error.

Here is my current clusterrole

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: sandbox-dev
  namespace: sandbox
rules:
  # pod get/watch is used to identify the container IDs of the current pod
  - apiGroups: ["", argoproj.io"] 
    resources:
      - pods
      - volumes
      - persistentvolumes
      - pods/log
      - pods/exec
      - configmaps
      - workflows
      - workflowtemplates
      - workflowtasksets
      - workflowtaskresult
    verbs:
      - get
      - create
      - watch
      - patch
      - list
      - delete
      - update