diff --git a/infra/cdk/README.md b/infra/cdk/README.md
index c790ad8..9485c85 100644
--- a/infra/cdk/README.md
+++ b/infra/cdk/README.md
@@ -42,7 +42,8 @@ The role grants only:
 - `elasticbeanstalk:UpdateEnvironment` on environment `shoc-backend-dev` only.
 - `s3:ListBucket` and `s3:GetBucketLocation` on
   `elasticbeanstalk-us-east-1-396287094661` (the official action's
-  ownership-safe bucket checks), plus `s3:CreateBucket` and
+  ownership-safe bucket checks), `s3:GetBucketPolicy` for the policy inspection
+  observed in attempt 11 of run `30448885838`, plus `s3:CreateBucket` and
   `s3:PutBucketOwnershipControls` on the same bucket-level ARN. Under the
   `shoc-backend/` object prefix only:
   `s3:PutObject`, `s3:GetObject`, and `s3:GetObjectVersion`, which the pinned
diff --git a/infra/cdk/deploy-dev-stack.ts b/infra/cdk/deploy-dev-stack.ts
index e0f3853..d501786 100644
--- a/infra/cdk/deploy-dev-stack.ts
+++ b/infra/cdk/deploy-dev-stack.ts
@@ -143,6 +143,7 @@ export class DeployDevStack extends cdk.Stack {
           's3:CreateBucket',
           's3:PutBucketOwnershipControls',
           's3:GetBucketLocation',
+          's3:GetBucketPolicy',
         ],
         resources: [bucketArn],
       }),