ACLs for access to RSA KeyContainer with a web app

I've written a web app that makes use of app-level cryptography to encrypt data in the database. This works fine on my dev machine, but when I run the same code on my production server things don't work because the app apparently can't open the KeyContainer.
I've set up the KeyContainer using aspnet_iisreg. I tried setting up ACLs for two "users," IIS_IUSRS (which I believe is the default identity that IIS uses), and IIS APPPOOL\DefaultAppPool, which is the identity I get when I capture WindowsIdentity.GetCurrent().Name in my C# code.
Here's the aspnet_regiis commands I used:
C:\Windows\Microsoft.NET\Framework\v4.0.30319>aspnet_regiis -pi "A1KeyContainer" c:\temp\A1KeyContainer.xml
Importing RSA Keys from file.. Succeeded!
C:\Windows\Microsoft.NET\Framework\v4.0.30319>aspnet_regiis -pa "A1KeyContainer" "IIS_IUSRS"
Adding ACL for access to the RSA Key container... Succeeded!
...