Unfortunately that's not properly documented yet - please refer to the following issue for details, the various comments resemble a community effort to track the currently required IAM permissions (I recommend to start from the latest comment accordingly):
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.