diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index f6801eb..2a33bac 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -792,9 +792,15 @@ Resources:
                 Effect: Allow
                 Action:
                   - lambda:Get*
-                  - lambda:List*
                 Resource:
                   - !Sub "arn:aws:lambda:us-east-1:${AWS::AccountId}:function:paychex-*"
+              # Collection/list APIs authorize only against Resource "*".
+              - Sid: RefreshLambdaList
+                Effect: Allow
+                Action:
+                  - lambda:ListFunctions
+                  - lambda:GetAccountSettings
+                Resource: "*"
               - Sid: RefreshArtifactsBucket
                 Effect: Allow
                 Action: