diff --git a/deployments/aws.yml b/deployments/aws.yml
index dab851f..65f445f 100644
--- a/deployments/aws.yml
+++ b/deployments/aws.yml
@@ -41,6 +41,9 @@ env:
   CONTAINER_NAME: MY_CONTAINER_NAME           # set this to the name of the container in the
                                                # containerDefinitions section of your task definition
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
     name: Deploy