diff --git a/src/deployments/cdk/src/deployments/iam/log-group-role.ts b/src/deployments/cdk/src/deployments/iam/log-group-role.ts
index faf67209a..1d28147d7 100644
--- a/src/deployments/cdk/src/deployments/iam/log-group-role.ts
+++ b/src/deployments/cdk/src/deployments/iam/log-group-role.ts
@@ -46,6 +46,7 @@ async function createRole(stack: AccountStack) {
         'logs:DeleteRetentionPolicy',
         'logs:DescribeLogGroups',
         'logs:AssociateKmsKey',
+        'logs:TagLogGroup',
       ],
       resources: ['*'],
     }),