diff --git a/modules/postgres-etl/extract/extract_s3.tf b/modules/postgres-etl/extract/extract_s3.tf
index 7a87ae23..4394dc22 100644
--- a/modules/postgres-etl/extract/extract_s3.tf
+++ b/modules/postgres-etl/extract/extract_s3.tf
@@ -35,6 +35,9 @@ resource "aws_s3_bucket_policy" "extract" {
         },
         "Action" : [
           "s3:GetObject",
+          "s3:PutObjectVersionTagging",
+          "s3:GetObjectTagging",
+          "s3:PutObjectVersionTagging",
           "s3:PutObject",
           "s3:DeleteObject",
           "s3:ListBucket",