diff --git a/terraform/environments/aws/ci-cd-permissions/monitoring_apply_test.go b/terraform/environments/aws/ci-cd-permissions/monitoring_apply_test.go
index 430716a2b..7adca1557 100644
--- a/terraform/environments/aws/ci-cd-permissions/monitoring_apply_test.go
+++ b/terraform/environments/aws/ci-cd-permissions/monitoring_apply_test.go
@@ -33,10 +33,11 @@ func TestDeployPolicyGrantsEveryActionTheMonitoringModuleNeeds(t *testing.T) {
 	add(alarm, "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:TagResource")
 	// The migration alarm's filter is on the Lambda log group; the monitoring
 	// module's filters are on the Lambda and ECS groups.
-	add(lambdaLG, "logs:PutMetricFilter", "logs:DeleteMetricFilter")
-	add(ecsLG, "logs:PutMetricFilter", "logs:DeleteMetricFilter")
+	// DescribeMetricFilters lists the log-group resource type in the SAR.
+	add(lambdaLG, "logs:PutMetricFilter", "logs:DeleteMetricFilter", "logs:DescribeMetricFilters")
+	add(ecsLG, "logs:PutMetricFilter", "logs:DeleteMetricFilter", "logs:DescribeMetricFilters")
 	// No resource-level permissions for these.
-	for _, a := range []string{"logs:DescribeMetricFilters", "logs:PutQueryDefinition", "logs:DescribeQueryDefinitions", "logs:DeleteQueryDefinition"} {
+	for _, a := range []string{"logs:PutQueryDefinition", "logs:DescribeQueryDefinitions", "logs:DeleteQueryDefinition"} {
 		needs = append(needs, grantNeed{action: a, noResource: true})
 	}
 	assertGranted(t, "monitoring", needs)
diff --git a/terraform/environments/aws/ci-cd-permissions/rds_scopes_test.go b/terraform/environments/aws/ci-cd-permissions/rds_scopes_test.go
index 2fb153fd1..10e20005d 100644
--- a/terraform/environments/aws/ci-cd-permissions/rds_scopes_test.go
+++ b/terraform/environments/aws/ci-cd-permissions/rds_scopes_test.go
@@ -123,7 +123,7 @@ var requiredRDSProxyTypes = map[string][]string{
 	"rds:DeleteDBProxy":            {"db-proxy"},
 	"rds:ModifyDBProxy":            {"db-proxy"},
 	"rds:RegisterDBProxyTargets":   {"db", "target-group"},
-	"rds:DeregisterDBProxyTargets": {"db-proxy", "target-group"},
+	"rds:DeregisterDBProxyTargets": {"db", "db-proxy", "target-group"},
 	"rds:ModifyDBProxyTargetGroup": {"target-group"},
 }