diff --git a/terraform/live/modules/environment-owned/main.tf b/terraform/live/modules/environment-owned/main.tf
index c4ef076..8bf364b 100644
--- a/terraform/live/modules/environment-owned/main.tf
+++ b/terraform/live/modules/environment-owned/main.tf
@@ -304,8 +304,9 @@ data "aws_iam_policy_document" "deploy" {
         "s3:DeleteObject",
       ]
       resources = [
-        "arn:aws:s3:::${local.eb_bucket_name}",
-        "arn:aws:s3:::${local.eb_bucket_name}/*",
+        "arn:aws:s3:::${local.eb_bucket_name}/${var.eb_application_name}/*",
+        "arn:aws:s3:::${local.eb_bucket_name}/resources/_runtime/_embedded_extensions/${var.eb_application_name}/*",
+        "arn:aws:s3:::${local.eb_bucket_name}/resources/environments/${var.eb_environment_id}/*",
       ]
     }
   }