diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index f2e8ee5..409d437 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -606,6 +606,11 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
       "s3:GetEncryptionConfiguration",
       "s3:GetLifecycleConfiguration",
       "s3:GetObject",
+      "s3:GetObjectAcl",
+      "s3:GetObjectAttributes",
+      "s3:GetObjectLegalHold",
+      "s3:GetObjectRetention",
+      "s3:GetObjectTagging",
       "s3:GetReplicationConfiguration",
       "s3:ListBucket",
     ]