diff --git a/terraform/aws-custom-policies.tf b/terraform/aws-custom-policies.tf
index 31edcc1..bb3112c 100644
--- a/terraform/aws-custom-policies.tf
+++ b/terraform/aws-custom-policies.tf
@@ -9,5 +9,9 @@ module "aws_custom_policies" {
       description = "Policy enforcing MFA for devops security users"
       filename    = "enforce-mfa-for-users-policy.json"
     }
+    "IncubatorTfPlanSecretsRead" = {
+      description = "Allows incubator tf plan role to read specific Secrets Manager secrets needed for terraform plan"
+      filename    = "incubator-tf-plan-secrets-read-policy.json"
+    }
   }
 }
diff --git a/terraform/aws-custom-policies/incubator-tf-plan-secrets-read-policy.json b/terraform/aws-custom-policies/incubator-tf-plan-secrets-read-policy.json
new file mode 100644
index 0000000..37cd9fd
--- /dev/null
+++ b/terraform/aws-custom-policies/incubator-tf-plan-secrets-read-policy.json
@@ -0,0 +1,17 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "AllowReadSpecificSecretsForTerraformPlan",
+      "Effect": "Allow",
+      "Action": [
+        "secretsmanager:GetSecretValue"
+      ],
+      "Resource": [
+        "arn:aws:secretsmanager:us-west-2:035866691871:secret:home-unite-us-cognito-client*",
+        "arn:aws:secretsmanager:us-west-2:035866691871:secret:home-unite-us-google-clientid*",
+        "arn:aws:secretsmanager:us-west-2:035866691871:secret:home-unite-us-google-secret*"
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/terraform/aws-gha-oidc-providers.tf b/terraform/aws-gha-oidc-providers.tf
index f6ca3db..ab561de 100644
--- a/terraform/aws-gha-oidc-providers.tf
+++ b/terraform/aws-gha-oidc-providers.tf
@@ -40,13 +40,17 @@ resource "aws_iam_role" "incubator_tf_plan" {
 }
 
 resource "aws_iam_role_policy_attachment" "incubator_tf_plan_readonly" {
-  role      = aws_iam_role.incubator_tf_plan.name
+  role       = aws_iam_role.incubator_tf_plan.name
   policy_arn = "arn:aws:iam::aws:policy/ReadOnlyAccess"
 }
 
+resource "aws_iam_role_policy_attachment" "incubator_tf_plan_secrets_read" {
+  role       = aws_iam_role.incubator_tf_plan.name
+  policy_arn = module.aws_custom_policies.policy_arns["IncubatorTfPlanSecretsRead"]
+}
+
 resource "aws_iam_role" "incubator_tf_apply" {
   name = "incubator-tf-apply"
-
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
     Statement = [