Using operator migrate to move to new VMs

I’ve seen that others have had apparent success using “vault operator migrate” to migrate vault & consul to new infrastructure. I’ve been trying to test that and am getting a 403 error

vault operator migrate -config migrate.hcl
2020-04-01T19:44:10.841Z [WARN] appending trailing forward slash to path
Error migrating: error writing entry: Unexpected response code: 403 (rpc error making call: Permission denied)

For a collection of reasons I am using the vault CLI on a 3rd VM which has valid network paths between the source and destination. Following the direction in the destination vault and consul are completely un-configured. Acl bootstrap has not been run and vault has not been touched. The source consul backend does have acl enabled, and I included the bootstrap token in the migrate.hcl as below:
storage_source “consul” {
address = “”
path = “vault/”
token = “acl_bootstrap_token”
storage_destination “consul” {
address = “”
path = “vault”

“consul members” and “consul info” to both source and dest return data.

How can I figure out what is giving me the 403 error?

Thanks - Mark