diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index f0340e8..89e1a92 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -471,6 +471,10 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
       "kms:CreateGrant",
       "kms:ListGrants",
       "kms:RetireGrant",
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+      "kms:GenerateDataKeyWithoutPlaintext",
     ]
     resources = [local.dynamodb_cmk_arn]
   }
@@ -553,6 +557,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
       "ec2:DeleteVpcEndpoints",
       "ec2:DescribeAccountAttributes",
       "ec2:DescribeAddresses",
+      "ec2:DescribeAddressesAttribute",
       "ec2:DescribeAvailabilityZones",
       "ec2:DescribeInternetGateways",
       "ec2:DescribeNatGateways",
@@ -819,6 +824,8 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
       "kms:DescribeKey",
       "kms:GetKeyPolicy",
       "kms:ListResourceTags",
+      "kms:CreateGrant",
+      "kms:ListGrants",
     ]
     resources = [local.dynamodb_cmk_arn]
   }
@@ -827,7 +834,9 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
     sid    = "RefreshEc2"
     effect = "Allow"
     actions = [
+      "ec2:DescribeAccountAttributes",
       "ec2:DescribeAddresses",
+      "ec2:DescribeAddressesAttribute",
       "ec2:DescribeAvailabilityZones",
       "ec2:DescribeInternetGateways",
       "ec2:DescribeNatGateways",