How to remove an EIP with Terraform?

Question

I deleted aws_eip resources and it's corresponding aws_nat_gateway allocation_id reference in terraform code. terraform plan correctly shows these resources being destroyed, however terraform apply results in the following error:

│ Error: disassociating EC2 EIP (eipassoc-02d1f94af0eb9ef67): AuthFailure: You do not have permission to access the specified resource.
│   status code: 400, request id: ...

The AWS access key I'm using has full administrator access, with the following IAM policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}

so what is preventing these resources from being destroyed?