diff --git a/lib/terraform-substrate/shoc-frontend-resources.ts b/lib/terraform-substrate/shoc-frontend-resources.ts
index 319d549..daf6721 100644
--- a/lib/terraform-substrate/shoc-frontend-resources.ts
+++ b/lib/terraform-substrate/shoc-frontend-resources.ts
@@ -164,6 +164,12 @@ const frontendReadPolicy = (
         ],
         Resource: roleArn(environment.deployRoleName),
       },
+      {
+        Sid: "ReadExactDeployBoundary",
+        Effect: "Allow",
+        Action: ["iam:GetPolicy", "iam:GetPolicyVersion"],
+        Resource: `arn:aws:iam::${ACCOUNT_ID}:policy/shoc-frontend-new-${environment.key}-deploy-boundary`,
+      },
       {
         Sid: "ReadGithubOidcProvider",
         Effect: "Allow",
diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 9acf137..14a10ea 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -3308,6 +3308,48 @@ Resources:
                   - elasticbeanstalk:UpdateEnvironment
                   - elasticbeanstalk:UpdateTagsForResource
                 Resource: arn:aws:elasticbeanstalk:us-east-1:396287094661:environment/shoc-backend/shoc-backend-dev
+              - Sid: ManageDevEnvironmentStack
+                Effect: Allow
+                Action:
+                  - cloudformation:CancelUpdateStack
+                  - cloudformation:DescribeStackEvents
+                  - cloudformation:DescribeStackResource
+                  - cloudformation:DescribeStackResources
+                  - cloudformation:DescribeStacks
+                  - cloudformation:GetTemplate
+                  - cloudformation:ListStackResources
+                  - cloudformation:UpdateStack
+                Resource: arn:aws:cloudformation:us-east-1:396287094661:stack/awseb-e-hehnrqjjrt-stack/*
+              - Sid: DescribeDeploymentResources
+                Effect: Allow
+                Action:
+                  - autoscaling:Describe*
+                  - ec2:Describe*
+                  - elasticloadbalancing:Describe*
+                Resource: "*"
+              - Sid: ManageDevEnvironmentAsg
+                Effect: Allow
+                Action:
+                  - autoscaling:PutNotificationConfiguration
+                  - autoscaling:ResumeProcesses
+                  - autoscaling:SuspendProcesses
+                Resource: arn:aws:autoscaling:us-east-1:396287094661:autoScalingGroup:*:autoScalingGroupName/awseb-e-hehnrqjjrt-stack-*
+              - Sid: LegacyBeanstalkObjects
+                Effect: Allow
+                Action:
+                  - s3:Delete*
+                  - s3:Get*
+                  - s3:Put*
+                Resource: arn:aws:s3:::elasticbeanstalk-*/*
+              - Sid: LegacyBeanstalkBuckets
+                Effect: Allow
+                Action:
+                  - s3:GetBucket*
+                  - s3:ListBucket
+                  - s3:PutBucketOwnershipControls
+                  - s3:PutBucketPolicy
+                  - s3:PutBucketPublicAccessBlock
+                Resource: arn:aws:s3:::elasticbeanstalk-*
               - Sid: PutDevRuntimePolicy
                 Effect: Allow
                 Action: iam:PutRolePolicy