diff --git a/cloud-aws-common/src/main/resources/definitions/aws-cb-policy.json b/cloud-aws-common/src/main/resources/definitions/aws-cb-policy.json
index e4b2cc35a15..2cdd36869cb 100644
--- a/cloud-aws-common/src/main/resources/definitions/aws-cb-policy.json
+++ b/cloud-aws-common/src/main/resources/definitions/aws-cb-policy.json
@@ -236,7 +236,8 @@
         "kms:TagResource",
         "kms:DeleteAlias",
         "kms:PutKeyPolicy",
-        "kms:ScheduleKeyDeletion"
+        "kms:ScheduleKeyDeletion",
+        "kms:GenerateDataKey"
       ],
       "Effect": "Allow",
       "Resource": [