The solution was to add the CreateServiceLinkedRole permission to the IAM role of the user making the calls, NOT the EMR service role.