diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 531b29805db..975123cad46 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -42,6 +42,8 @@ https://github.com/elastic/beats/compare/v7.0.0...7.1[Check the HEAD diff]
 
 *Metricbeat*
 
+- Update documentation with cloudwatch:ListMetrics permission. {pull}11987[11987]
+
 *Packetbeat*
 
 *Winlogbeat*
diff --git a/x-pack/metricbeat/module/aws/ec2/_meta/docs.asciidoc b/x-pack/metricbeat/module/aws/ec2/_meta/docs.asciidoc
index da05069eb2b..4490ac688e4 100644
--- a/x-pack/metricbeat/module/aws/ec2/_meta/docs.asciidoc
+++ b/x-pack/metricbeat/module/aws/ec2/_meta/docs.asciidoc
@@ -35,8 +35,9 @@ We fetch the following data:
 Some specific AWS permissions are required for IAM user to collect AWS EC2 metrics.
 ----
 ec2:DescribeInstances
-cloudwatch:GetMetricData
 ec2:DescribeRegions
+cloudwatch:GetMetricData
+cloudwatch:ListMetrics
 ----
 
 [float]