diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 7d92126..bcfc1b8 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -433,12 +433,7 @@ Resources:
               - Sid: RefreshLambda
                 Effect: Allow
                 Action:
-                  - lambda:GetFunction
-                  - lambda:GetFunctionConfiguration
-                  - lambda:GetPolicy
-                  - lambda:GetLayerVersion
-                  - lambda:ListVersionsByFunction
-                  - lambda:ListTags
+                  - lambda:*
                 Resource:
                   - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:afi-*"
                   - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:layer:afi-shared*"
@@ -480,34 +475,15 @@ Resources:
           PolicyDocument:
             Version: "2012-10-17"
             Statement:
-              - Sid: LambdaFunctions
+              # lambda:*/events:* on stack prefixes — AWS provider reads many
+              # Get* attributes (e.g. GetFunctionCodeSigningConfig) that lag any
+              # enumerated allow-list (PLAT-56 first-apply misses).
+              - Sid: LambdaAll
                 Effect: Allow
                 Action:
-                  - lambda:CreateFunction
-                  - lambda:DeleteFunction
-                  - lambda:GetFunction
-                  - lambda:GetFunctionConfiguration
-                  - lambda:UpdateFunctionCode
-                  - lambda:UpdateFunctionConfiguration
-                  - lambda:ListVersionsByFunction
-                  - lambda:PublishVersion
-                  - lambda:TagResource
-                  - lambda:UntagResource
-                  - lambda:ListTags
-                  - lambda:AddPermission
-                  - lambda:RemovePermission
-                  - lambda:GetPolicy
-                  - lambda:InvokeFunction
+                  - lambda:*
                 Resource:
                   - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:afi-*"
-              - Sid: LambdaLayers
-                Effect: Allow
-                Action:
-                  - lambda:PublishLayerVersion
-                  - lambda:DeleteLayerVersion
-                  - lambda:GetLayerVersion
-                  - lambda:ListLayerVersions
-                Resource:
                   - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:layer:afi-shared*"
               - Sid: LambdaList
                 Effect: Allow
@@ -519,17 +495,7 @@ Resources:
               - Sid: EventBridgeRules
                 Effect: Allow
                 Action:
-                  - events:PutRule
-                  - events:DeleteRule
-                  - events:DescribeRule
-                  - events:EnableRule
-                  - events:DisableRule
-                  - events:PutTargets
-                  - events:RemoveTargets
-                  - events:ListTargetsByRule
-                  - events:TagResource
-                  - events:UntagResource
-                  - events:ListTagsForResource
+                  - events:*
                 Resource:
                   - !Sub "arn:aws:events:us-east-1:${AWS::AccountId}:rule/afi-*"
               - Sid: CloudWatchLogs