At minimum, you must have escalated VPC privileged on your IAM. Not just read only, but write and tags to several items of VPCs. But maybe you just can start with Amazon Managed Policy VPC Full Access and later you can modify it with only needed rules