The action name is `tag:GetResources`, not `tags:GetResources`. This creates a confusing error message that can have the user add the wrong permission to the IAM role.
