diff --git a/tf/iam.tf b/tf/iam.tf
index 6f6e3f4..2afedab 100644
--- a/tf/iam.tf
+++ b/tf/iam.tf
@@ -21,6 +21,7 @@ data "aws_iam_policy_document" "deploy" {
 
   statement {
     actions = [
+      "ecr:BatchGetImage",
       "ecr:ListImages",
     ]