Implicit vs Explicit Dependencies

An EC2 instance's user data script downloads a file from S3 at boot. The permission comes from an aws_iam_role_policy that nothing in the instance block references, and on first apply the download sometimes fails with access denied. What is the fix?