diff --git a/terraform/iam.tf b/terraform/iam.tf
index 6fc2209e..d77b9a54 100644
--- a/terraform/iam.tf
+++ b/terraform/iam.tf
@@ -186,8 +186,7 @@ resource "aws_iam_role_policy_attachment" "ecs_dynamo_attach" {
 data "aws_iam_policy_document" "transfer-tracker-db-indexes-access" {
   statement {
     actions = [
-      "dynamodb:Query",
-      "dynamodb:Scan"
+      "dynamodb:Query"
     ]
     resources = [
       "arn:aws:dynamodb:${var.region}:${data.aws_caller_identity.current.account_id}:table/${aws_dynamodb_table.transfer_tracker.name}/index/*"