unauthRole/CognitoIdentityCredentials is not authorized to perform: geo:ListGeofences

I am trying to use the AWS SDK to access Location object.

location.batchUpdateDevicePosition works fine.

but location.listGeofences complains that CognitoIdentityCredentials is not authorized to perform: geo:ListGeofences on resource: arn:aws:geo:us-west-2::*

geo:ListGeofences is already in the role policy, why it is still complaining?

Any ideas?

#policy
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "geo:*",
            "Resource": "*"
        },
        {
            "Sid": "GetDevicePositions",
            "Effect": "Allow",
            "Action": [
                "geo:ListGeofences",
                "geo:BatchGetDevicePosition",
                "geo:GetDevicePosition",
                "geo:GetDevicePositionHistory"
            ],
            "Resource": "*"
        }
    ]
}

import Amplify, {Auth, PubSub} from 'aws-amplify';
import awsconfig from '../aws-exports';
import AWS from 'aws-sdk';
import Location from 'aws-sdk/clients/location';

Amplify.configure(awsconfig);
 Auth.currentCredentials().then(credentials => {
        console.log(Auth.essentialCredentials(credentials));
        console.log(AWS);
        const location = new Location({
            region: awsconfig.aws_project_region,
            credentials: Auth.essentialCredentials(credentials),
        });

        const updateDevicePosition = new Promise((resolve, reject) => {
            console.log({ params });
            location.batchUpdateDevicePosition(params, function (err, data) {
                if (err) {
                    console.log(err, err.stack); // an error occurred
                    reject(err);
                } else {
                    console.log('->>>>>TRACKER: ', data);
                    resolve(data);
                }           // successful response
            });
        });

        const listGeofences = new Promise((resolve, reject) => {
            location.listGeofences({CollectionName: 'explore.geofence-collection'}, (err, data) => {
                if (err) {
                    console.log(err, err.stack); // an error occurred
                    reject(err);
                } else {
                    console.log('listGeofences: ', data);
                    resolve(data);
                } // successful response
            });
        });

        listGeofences.then(()=>console.log('LIST'))
        updateDevicePosition.then(() => {
            console.log('complete');
        });

    });