diff --git a/lwpreflight/aws/constants.go b/lwpreflight/aws/constants.go
index a2aa56919..eeaa533dc 100644
--- a/lwpreflight/aws/constants.go
+++ b/lwpreflight/aws/constants.go
@@ -120,7 +120,9 @@ var RequiredPermissions = map[IntegrationType][]string{
 		"s3:PutBucketOwnershipControls",
 		"s3:PutBucketPolicy",
 		"s3:PutBucketPublicAccessBlock",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:PutBucketVersioning",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutLifecycleConfiguration",
@@ -225,7 +227,9 @@ var RequiredPermissions = map[IntegrationType][]string{
 		"s3:PutBucketOwnershipControls",
 		"s3:PutBucketPolicy",
 		"s3:PutBucketPublicAccessBlock",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:PutBucketVersioning",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutObject",
@@ -275,11 +279,15 @@ var RequiredPermissions = map[IntegrationType][]string{
 		"s3:PutLifecycleConfiguration",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutBucketNotification",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:DeleteObjectVersion",
 		"iam:CreateRole",
 		"iam:DeleteRole",
 		"iam:GetRole",
+		"iam:GetRolePolicy",
+		"iam:GetUserPolicy",
 		"iam:ListRolePolicies",
 		"iam:ListAttachedRolePolicies",
 		"iam:ListPolicyVersions",
@@ -466,7 +474,9 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
 		"s3:PutBucketOwnershipControls",
 		"s3:PutBucketPolicy",
 		"s3:PutBucketPublicAccessBlock",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:PutBucketVersioning",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutLifecycleConfiguration",
@@ -553,6 +563,7 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
 		"s3:GetBucketPublicAccessBlock",
 		"s3:GetBucketRequestPayment",
 		"s3:GetBucketTagging",
+		"s3:ListTagsForResource",
 		"s3:GetBucketVersioning",
 		"s3:GetBucketWebsite",
 		"s3:GetEncryptionConfiguration",
@@ -655,7 +666,9 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
 		"s3:PutBucketOwnershipControls",
 		"s3:PutBucketPolicy",
 		"s3:PutBucketPublicAccessBlock",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:PutBucketVersioning",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutObject",
@@ -711,11 +724,15 @@ var RequiredPermissionsForOrg = map[IntegrationType][]string{
 		"s3:PutLifecycleConfiguration",
 		"s3:PutEncryptionConfiguration",
 		"s3:PutBucketNotification",
+		"s3:ListTagsForResource",
 		"s3:PutBucketTagging",
+		"s3:TagResource",
 		"s3:DeleteObjectVersion",
 		"iam:CreateRole",
 		"iam:DeleteRole",
 		"iam:GetRole",
+		"iam:GetRolePolicy",
+		"iam:GetUserPolicy",
 		"iam:ListRolePolicies",
 		"iam:ListAttachedRolePolicies",
 		"iam:ListPolicyVersions",