diff --git a/lib/terraform-substrate/terraform-substrate.template.yaml b/lib/terraform-substrate/terraform-substrate.template.yaml
index 5199016..331d86f 100644
--- a/lib/terraform-substrate/terraform-substrate.template.yaml
+++ b/lib/terraform-substrate/terraform-substrate.template.yaml
@@ -1791,6 +1791,21 @@ Resources:
                 Action:
                   - logs:DescribeLogGroups
                 Resource: "*"
+              # HTTP API stage access_log_settings uses the Log Delivery APIs.
+              # These are account-level (Resource "*"); scoped log-group ARNs
+              # above are insufficient. Mirrors deploy-substrate
+              # cloudwatch-logs-management LogDelivery actions.
+              - Sid: MealOrderApiGwAccessLogDelivery
+                Effect: Allow
+                Action:
+                  - logs:CreateLogDelivery
+                  - logs:GetLogDelivery
+                  - logs:UpdateLogDelivery
+                  - logs:DeleteLogDelivery
+                  - logs:ListLogDeliveries
+                  - logs:PutResourcePolicy
+                  - logs:DescribeResourcePolicies
+                Resource: "*"
               - Sid: StackBuckets
                 Effect: Allow
                 Action: