diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index ff90bf3..5df4dde 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -498,26 +498,14 @@ Resources:
                 Resource: "*"
               # Artifact bucket for HCP plan/apply split: zip bytes travel in the
               # plan via aws_s3_object content_base64 (local archive_file paths
-              # from the plan worker are not on the apply worker).
+              # from the plan worker are not on the apply worker). Action set is
+              # s3:* on this bucket only — the AWS provider reads many GetBucket*
+              # attributes (e.g. GetBucketAcl) after CreateBucket; enumerating
+              # them lags provider upgrades (PLAT-56 first-apply miss).
               - Sid: LambdaArtifactsBucket
                 Effect: Allow
                 Action:
-                  - s3:CreateBucket
-                  - s3:DeleteBucket
-                  - s3:GetBucketLocation
-                  - s3:GetBucketPolicy
-                  - s3:PutBucketPolicy
-                  - s3:DeleteBucketPolicy
-                  - s3:GetBucketVersioning
-                  - s3:PutBucketVersioning
-                  - s3:GetBucketPublicAccessBlock
-                  - s3:PutBucketPublicAccessBlock
-                  - s3:GetBucketTagging
-                  - s3:PutBucketTagging
-                  - s3:ListBucket
-                  - s3:GetObject
-                  - s3:PutObject
-                  - s3:DeleteObject
+                  - s3:*
                 Resource:
                   - !Sub "arn:aws:s3:::afi-backup-monitor-artifacts-${AWS::AccountId}"
                   - !Sub "arn:aws:s3:::afi-backup-monitor-artifacts-${AWS::AccountId}/*"