diff --git a/terraform/aws-custom-policies.tf b/terraform/aws-custom-policies.tf
index 31edcc1..ac2c698 100644
--- a/terraform/aws-custom-policies.tf
+++ b/terraform/aws-custom-policies.tf
@@ -9,5 +9,9 @@ module "aws_custom_policies" {
       description = "Policy enforcing MFA for devops security users"
       filename    = "enforce-mfa-for-users-policy.json"
     }
+    "IncubatorTfPlanSecretsRead" = {
+      description = "Allows incubator tf plan role to read specific Secrets Manager secrets needed for terraform plan"
+      filename    = "tf-plan-scoped.json"
+    }
   }
 }
diff --git a/terraform/aws-custom-policies/tf-plan-scoped.json b/terraform/aws-custom-policies/tf-plan-scoped.json
new file mode 100644
index 0000000..95c9af4
--- /dev/null
+++ b/terraform/aws-custom-policies/tf-plan-scoped.json
@@ -0,0 +1,15 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AllowReadSpecificSecretsForTerraformPlan",
+      "Effect": "Allow",
+      "Action": [
+        "secretsmanager:GetSecretValue"
+      ],
+      "Resource": [
+        "arn:aws:secretsmanager:us-west-2:035866691871:secret:*"
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/terraform/aws-gha-oidc-providers.tf b/terraform/aws-gha-oidc-providers.tf
index f6ca3db..ab561de 100644
--- a/terraform/aws-gha-oidc-providers.tf
+++ b/terraform/aws-gha-oidc-providers.tf
@@ -40,13 +40,17 @@ resource "aws_iam_role" "incubator_tf_plan" {
 }
 
 resource "aws_iam_role_policy_attachment" "incubator_tf_plan_readonly" {
-  role      = aws_iam_role.incubator_tf_plan.name
+  role       = aws_iam_role.incubator_tf_plan.name
   policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
 }
 
+resource "aws_iam_role_policy_attachment" "incubator_tf_plan_secrets_read" {
+  role       = aws_iam_role.incubator_tf_plan.name
+  policy_arn = module.aws_custom_policies.policy_arns["IncubatorTfPlanSecretsRead"]
+}
+
 resource "aws_iam_role" "incubator_tf_apply" {
   name = "incubator-tf-apply"
-
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
diff --git a/terraform/modules/aws-gha-oidc-providers/main.tf b/terraform/modules/aws-gha-oidc-providers/main.tf
index 44178a1..7f9e6b2 100644
--- a/terraform/modules/aws-gha-oidc-providers/main.tf
+++ b/terraform/modules/aws-gha-oidc-providers/main.tf
@@ -50,8 +50,7 @@ resource "aws_iam_openid_connect_provider" "github_actions" {
 
 resource "aws_iam_role" "github_actions_oidc" {
 
-  name                = var.role_name
-  managed_policy_arns = var.policy_arns
+  name = var.role_name
 
   assume_role_policy = jsonencode({
     "Version" : "2012-10-17",
@@ -71,4 +70,11 @@ resource "aws_iam_role" "github_actions_oidc" {
       }
     }]
   })
+}
+
+resource "aws_iam_role_policy_attachment" "github_actions_oidc" {
+  for_each = toset(var.policy_arns)
+
+  role       = aws_iam_role.github_actions_oidc.name
+  policy_arn = each.value
 }
\ No newline at end of file