diff --git a/aws/logs_monitoring/template.yaml b/aws/logs_monitoring/template.yaml
index 87011b012..3ed7a7fc1 100644
--- a/aws/logs_monitoring/template.yaml
+++ b/aws/logs_monitoring/template.yaml
@@ -495,6 +495,10 @@ Resources:
               Action:
                 - s3:GetObject
               Resource: "*"
+            - Effect: Allow
+              Action:
+                - kms:Decrypt
+              Resource: "*"
             - Effect: Allow
               Action:
                 - secretsmanager:GetSecretValue