diff --git a/aws/policy/paas.yaml b/aws/policy/paas.yaml
index f9ff64de..e78950b0 100644
--- a/aws/policy/paas.yaml
+++ b/aws/policy/paas.yaml
@@ -40,7 +40,10 @@ Statement:
       - lambda:GetFunction
       - lambda:GetFunctionConfiguration
       - lambda:GetPolicy
+      - lambda:ListTags
       - lambda:RemovePermission
+      - lambda:TagResource
+      - lambda:UntagResource
       - lambda:UpdateAlias
       - lambda:UpdateFunctionConfiguration
       - lightsail:AllocateStaticIp