The UI tab says to select DNSBindingConnector as the role. The other three tabs (CLI, API, and Terraform) all use the standard Viewer role, instead. I found that the Viewer role didn't allow me to create DNS resolution bindings, so I believe the UI tab is correct and the others are incorrect.
Thank you @davesteinberg! Yes, you are correct.... You need the DNSBindingConnector role. Thank you for opening a Git issue so that I can get this corrected. Update forthcoming.
On this page: https://cloud.ibm.com/docs/vpc?topic=vpc-hub-spoke-s2s-auth&interface=ui
The UI tab says to select DNSBindingConnector as the role. The other three tabs (CLI, API, and Terraform) all use the standard Viewer role, instead. I found that the Viewer role didn't allow me to create DNS resolution bindings, so I believe the UI tab is correct and the others are incorrect.