diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index ceb87b6..f2e8ee5 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -605,13 +605,17 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
       "s3:GetBucketWebsite",
       "s3:GetEncryptionConfiguration",
       "s3:GetLifecycleConfiguration",
+      "s3:GetObject",
       "s3:GetReplicationConfiguration",
       "s3:ListBucket",
     ]
     resources = [
       "arn:aws:s3:::${local.backup_bucket_name}",
+      "arn:aws:s3:::${local.backup_bucket_name}/*",
       "arn:aws:s3:::${local.replica_bucket_name}",
+      "arn:aws:s3:::${local.replica_bucket_name}/*",
       "arn:aws:s3:::${local.artifacts_bucket_name}",
+      "arn:aws:s3:::${local.artifacts_bucket_name}/*",
     ]
   }