diff --git a/baton/aws.mdx b/baton/aws.mdx
index f00bf9cf..dd214633 100644
--- a/baton/aws.mdx
+++ b/baton/aws.mdx
@@ -346,8 +346,10 @@ The permissions policy below is broken into several sections to align with these
 	        "identitystore:ListUsers",
 	        "organizations:ListAccounts",
 	        "sso:DescribePermissionSet",
+	        "sso:GetInlinePolicyForPermissionSet",
 	        "sso:ListAccountAssignments",
 	        "sso:ListInstances",
+	        "sso:ListManagedPoliciesInPermissionSet",
 	        "sso:ListPermissionSets",
 	        "sso:ListPermissionSetsProvisionedToAccount",
 	        "iam:GetUser",
@@ -445,7 +447,7 @@ The permissions policy below is broken into several sections to align with these
 	- `iam:List..., iam:GetGroup`: These are standard IAM permissions for listing users, groups, and roles. They are necessary to identify resources within your AWS account. iam:GetGroup provides the members of a group.
 	- `identitystore:List...`: These permissions are specific to AWS IAM Identity Center. They allow C1 to list and read information about your users and groups as they are defined within the Identity Center.
 	- `organizations:ListAccounts`: This permission is required to list all the accounts within your AWS Organization, enabling C1 to understand your account structure.
-	- `sso:List..., sso:Describe...`: These permissions allow C1 to list your permission sets and see how they are assigned to accounts and users.
+	- `sso:List..., sso:Describe..., sso:Get...`: These permissions allow C1 to list your permission sets, see how they are assigned to accounts and users, and read the inline and managed IAM policies attached to each permission set.
 	- `iam:GetUser, and various iam:List... permissions`: These permissions are necessary for C1 to first retrieve all associated credentials and metadata for an IAM user before a complete deletion can be performed.
 	**Section 2: Provisioning access (“C1ProvisionAccess”)**
 	This group of permissions is only required if you want to provision (create or delete) user assignments in AWS, including managing IAM users directly. For example, if you plan to use C1 to add a user to a group, assign a permission set to a user, create an IAM user, or fully delete an IAM user, you will need to include these permissions.
@@ -731,8 +733,10 @@ resource "aws_iam_role" "ConductorOneIntegration" {
             "identitystore:ListUsers",
             "organizations:ListAccounts",
             "sso:DescribePermissionSet",
+            "sso:GetInlinePolicyForPermissionSet",
             "sso:ListAccountAssignments",
             "sso:ListInstances",
+            "sso:ListManagedPoliciesInPermissionSet",
             "sso:ListPermissionSets",
             "sso:ListPermissionSetsProvisionedToAccount"
           ],