diff --git a/.github/workflows/arrow-aws.yml b/.github/workflows/arrow-aws.yml
index 731d303..76fc31d 100644
--- a/.github/workflows/arrow-aws.yml
+++ b/.github/workflows/arrow-aws.yml
@@ -30,6 +30,10 @@ on:
         options:
           - t3a.small # 2 GB RAM / $10
 
+permissions:
+  id-token: write
+  contents: write
+
 jobs:
   build-deploy:
     name: Build and Deploy