diff --git a/waf/policy/submodule/firehose.tf b/waf/policy/submodule/firehose.tf
index 66d1115..7d86e5e 100644
--- a/waf/policy/submodule/firehose.tf
+++ b/waf/policy/submodule/firehose.tf
@@ -57,7 +57,8 @@ resource "aws_iam_policy" "firehose-role-policy" {
                 "s3:GetObject",
                 "s3:ListBucket",
                 "s3:ListBucketMultipartUploads",
-                "s3:PutObject"
+                "s3:PutObject",
+                "s3:PutObjectAcl"
             ],
             "Resource": [
                 "${var.logging_bucket_arn}",