diff --git a/cdk/lib/cdk-stack.ts b/cdk/lib/cdk-stack.ts
index a56d6b26..1fad4b74 100644
--- a/cdk/lib/cdk-stack.ts
+++ b/cdk/lib/cdk-stack.ts
@@ -101,6 +101,7 @@ export class S3ECPythonGithub extends cdk.Stack {
             new PolicyStatement({
               effect: Effect.ALLOW,
               actions: [
+                "s3:HeadObject", // Only get object metadata
                 "s3:PutObject",
                 "s3:GetObject",
                 "s3:DeleteObject",