diff --git a/pipeline/outputs/cloudwatch.md b/pipeline/outputs/cloudwatch.md
index bfcd2ba2d..a400b422e 100644
--- a/pipeline/outputs/cloudwatch.md
+++ b/pipeline/outputs/cloudwatch.md
@@ -84,7 +84,8 @@ The following AWS IAM permissions are required to use this plugin:
 		"Action": [
 			"logs:CreateLogStream",
 			"logs:CreateLogGroup",
-			"logs:PutLogEvents"
+			"logs:PutLogEvents",
+                        "logs:putRetentionPolicy"
 		],
 		"Resource": "*"
 	}]
@@ -260,4 +261,4 @@ You can use our SSM Public Parameters to find the Amazon ECR image URI in your r
 aws ssm get-parameters-by-path --path /aws/service/aws-for-fluent-bit/
 ```
 
-For more see [the AWS for Fluent Bit github repo](https://github.com/aws/aws-for-fluent-bit#public-images).
\ No newline at end of file
+For more see [the AWS for Fluent Bit github repo](https://github.com/aws/aws-for-fluent-bit#public-images).