Ah. sorry for the confusion. We also had discussion about this over the slack.
Looks like the correct permissions for the key using ec2_sd_config
"tag:GetResources",
"cloudwatch:ListTagsForResource",
"ec2:DescribeTags",
"ec2:DescribeInstances",
"ec2:DescribeRegions",
"elasticloadbalancing:DescribeTargetGroups"