diff --git a/aws/policy/networking.yaml b/aws/policy/networking.yaml
index e9bc8da0..75a26168 100644
--- a/aws/policy/networking.yaml
+++ b/aws/policy/networking.yaml
@@ -10,6 +10,8 @@ Statement:
       - route53:GetHostedZone
       - route53:DeleteHostedZone
       - route53:UpdateHostedZoneComment
+      - route53:ChangeTagsForResource
+      - route53:ListTagsForResource
     Resource: "*"
   - Sid: AllowRegionalUnrestrictedResourceActionsWhichIncurNoFees
     Effect: Allow