diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index d1d97c6..8af2c84 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1472,6 +1472,14 @@ Resources:
                   - cloudfront:Get*
                   - cloudfront:List*
                 Resource: "*"
+              # aws_cloudfront_function refresh reads DEVELOPMENT via
+              # DescribeFunction. Get* does not cover that API (PLAT-106).
+              - Sid: RefreshCloudFrontFunction
+                Effect: Allow
+                Action:
+                  - cloudfront:DescribeFunction
+                Resource:
+                  - !Sub "arn:aws:cloudfront::${AWS::AccountId}:function/seahaven-site-prod-directory-index"
               - Sid: RefreshAcm
                 Effect: Allow
                 Action: