diff --git a/cf/irsa-api-role.yaml b/cf/irsa-api-role.yaml
index 490b078e5b..734ad60567 100644
--- a/cf/irsa-api-role.yaml
+++ b/cf/irsa-api-role.yaml
@@ -209,6 +209,7 @@ Resources:
                   - "cognito-idp:DescribeUserPool"
                   - "cognito-idp:DescribeUserPoolClient"
                   - "cognito-idp:AdminGetUser"
+                  - "cognito-idp:ListUsers"
                 Resource: '*'
 
         - PolicyName: "can-access-rds"