The ClusterManager role currently does not allow for operations against time-series buckets collections. I believe we need to add the following privilege to allow:

Privilege(ResourcePattern::forAnySystemBuckets(), clusterManagerRoleDatabaseActions)