diff --git a/tf/modules/oonidevops_github_user/templates/oonidevops_github_policy.json b/tf/modules/oonidevops_github_user/templates/oonidevops_github_policy.json
index d435c34a..85ed8450 100644
--- a/tf/modules/oonidevops_github_user/templates/oonidevops_github_policy.json
+++ b/tf/modules/oonidevops_github_user/templates/oonidevops_github_policy.json
@@ -125,6 +125,8 @@
                 "secretsmanager:Describe*",
                 "secretsmanager:GetResourcePolicy",
                 "secretsmanager:List*",
+                "secretsmanager:GetSecretValue",
+                "secretsmanager:DescribeSecret",
                 "servicediscovery:DiscoverInstances",
                 "servicediscovery:DiscoverInstancesRevision",
                 "servicediscovery:Get*",