only requires DescribeTags permission