diff --git a/src/templates/cromwell/cromwell-server.template.yaml b/src/templates/cromwell/cromwell-server.template.yaml
index 8081d84df..0f9716cad 100644
--- a/src/templates/cromwell/cromwell-server.template.yaml
+++ b/src/templates/cromwell/cromwell-server.template.yaml
@@ -142,7 +142,7 @@ Resources:
                 Action:
                   - "s3:ListBucket"
                   - "s3:ListAllMyBuckets"
-
+                  - "s3:GetObject"
         
         - PolicyName: !Sub CromwellServer-CloudWatch-Access-${AWS::Region}
           PolicyDocument: