Hey Nick,
The instance role permissions should look like this:
and in the App Runner setup, this instance role should be attached to the app runner instance you are creating, as detailed in this guide .
Please note, that it is not possible to change the instance role after you have created the instance runner app.