diff --git a/infra/aws/main/iam.tf b/infra/aws/main/iam.tf
index 417526e..6e76923 100644
--- a/infra/aws/main/iam.tf
+++ b/infra/aws/main/iam.tf
@@ -39,6 +39,7 @@ data "aws_iam_policy_document" "github_actions_infrastructure" {
       "iam:CreateOpenIDConnectProvider",
       "iam:GetOpenIDConnectProvider",
       "iam:UpdateOpenIDConnectProvider",
+      "iam:UpdateOpenIDConnectProviderThumbprint",
       "iam:DeleteOpenIDConnectProvider",
       "iam:ListOpenIDConnectProviders",
       "iam:TagOpenIDConnectProvider",
@@ -55,6 +56,7 @@ data "aws_iam_policy_document" "github_actions_infrastructure" {
     effect = "Allow"
     actions = [
       "iam:CreatePolicy",
+      "iam:CreatePolicyVersion",
       "iam:GetPolicy",
       "iam:GetPolicyVersion",
       "iam:ListPolicyVersions",