Can not publish to encrypted SNS topic from ECS fargate task

Customer managed key associated with topic with the following key policy:

{
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::XXXXXXXXXX:root"
    },
    "Action": "kms:*",
    "Resource": "*"
}

According to this: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html

The evaluated permissions are a union of resource and identity policies (if you disregard policy boundaries and explicit denies).

So my question: my ECS task execution role is still complaining about missing permissions:

arn:aws:sts::XXXXXXXXX:assumed-role/ecs-task-role/XXXXX is not authorized to perform: kms:GenerateDataKey on resource: arn:aws:kms:eu-west-1:XXXXXXXXX:key/XXXXXXXX

I can of course add kms:GenerateDataKey++ to the identity policy of the role in question, but why is this necessary?