AWS add option group
I signed up for paid support and here's the answer, in case it helps anyone else. I had to edit the trust policy on the IAM role like so:
{
"Version": "2012-10-17",
"Statement":
[{
"Effect": "Allow",
"Principal": {"Service": "rds.amazonaws.com"},
"Action": "sts:AssumeRole"
}]
}
Then I was able to add the option to the option group and the restore worked. Note that the trust policy is called "trust relationship" on the web console.