diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 0fa6684..2c11a7d 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1695,6 +1695,8 @@ Resources:
                 Action:
                   - ssm:GetParameter
                   - ssm:GetParameters
+                  # aws_ssm_parameter refresh lists tags on managed parameters.
+                  - ssm:ListTagsForResource
                 Resource:
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/seahaven/waf/app-web-acl-arn"
                   - !Sub "arn:aws:ssm:us-east-1:${AWS::AccountId}:parameter/meal-order-manager/*"