diff --git a/gen3/bin/kube-setup-gen3-workflow.sh b/gen3/bin/kube-setup-gen3-workflow.sh
index 26a9b9360..21de564ec 100644
--- a/gen3/bin/kube-setup-gen3-workflow.sh
+++ b/gen3/bin/kube-setup-gen3-workflow.sh
@@ -91,6 +91,7 @@ setup_gen3_workflow_infra() {
       "Effect": "Allow",
       "Action": [
           "kms:CreateKey",
+          "kms:GenerateDataKey",
           "kms:CreateAlias",
           "kms:DescribeKey",
           "kms:TagResource"