ssm:SendCommand from lambda IAM permissions needed

For the life of me I cannot figure out what permissions combinations sendCommand needs to be able to send a Run Command targetting Resource Groups.

I am trying to least-privilege only allowing a certain document but to all ec2 instance in a resouceGroup.

ssmSenderlambdaRole.addToPolicy(new PolicyStatement({
      effect: Effect.ALLOW,
      actions: ['ssm:SendCommand'],
      resources: [
        linuxDocumentArn,
        windowsDocumentArn,
        `arn:aws:ec2:${Aws.REGION}:${Aws.ACCOUNT_ID}:instance/*`
      ],
    }));

    ssmSenderlambdaRole.addToPolicy(new PolicyStatement({
      effect: Effect.ALLOW,
      actions: ['resource-groups:*'],
      resources: ['*'],
    }));

accessDeniedConsole:

Some days you just wanna yell at AWS

In order to target resource groups you also need to have ["tag:GetResources"]

ssmSenderlambdaRole.addToPolicy(new PolicyStatement({
  effect: Effect.ALLOW,
  actions: ["resource-groups:ListResourceTypes",
            "resource-groups:SearchResources",
            "resource-groups:GetGroup",
            "resource-groups:GetTags",
            "resource-groups:ListGroupResources",
            "resource-groups:ListGroups"],
  resources: [rgWindowsArn, rgLinuxArn],
}));

ssmSenderlambdaRole.addToPolicy(new PolicyStatement({
  effect: Effect.ALLOW,
  actions: ["tag:GetResources"],
  resources: ["*"]  
}));