diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 9a98f28..b49e8c8 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -634,6 +634,7 @@ resource "aws_iam_role_policy" "hcptf_plan_refresh" {
       },
       {
         Action = [
+          "cloudfront:DescribeFunction",
           "cloudfront:Get*",
           "cloudfront:List*",
         ]
diff --git a/tests/test_terraform_menu_api.py b/tests/test_terraform_menu_api.py
index 7682492..8b5e93c 100644
--- a/tests/test_terraform_menu_api.py
+++ b/tests/test_terraform_menu_api.py
@@ -77,6 +77,7 @@ def test_cloudfront_forwards_portal_api_paths_without_publish_or_roster():
     assert "custom_error_response" not in cloudfront
     assert 'resource "aws_cloudfront_function" "form_spa_rewrite"' in cloudfront
     assert "function_arn = aws_cloudfront_function.form_spa_rewrite.arn" in cloudfront
+    assert "cloudfront:DescribeFunction" in _read("hcp_iam.tf")
     assert "AllViewerExceptHostHeader" in locals_tf or (
         "b689b0a8-53d0-40ab-baf2-68738e2966ac" in locals_tf
     )