Ok this is an easy one. Go to the Roles section of IAM in the web console and search for the permission you care about. For example I want to know which roles get "networkservices.meshes.list". I search for "networkservices.meshes.list" and all the roles that have it are returned.