diff --git a/03-AdvancedPermissionsAndAccounts/04_Cross-AccountPermissions/01_DEMOSETUP/petpics2_policy.json b/03-AdvancedPermissionsAndAccounts/04_Cross-AccountPermissions/01_DEMOSETUP/petpics2_policy.json
index 69a3ab0..400264b 100644
--- a/03-AdvancedPermissionsAndAccounts/04_Cross-AccountPermissions/01_DEMOSETUP/petpics2_policy.json
+++ b/03-AdvancedPermissionsAndAccounts/04_Cross-AccountPermissions/01_DEMOSETUP/petpics2_policy.json
@@ -10,7 +10,8 @@
               "s3:GetObject",
               "s3:PutObject",
               "s3:PutObjectAcl",
-              "s3:ListBucket"
+              "s3:ListBucket",
+              "s3:GetBucketOwnershipControls"
           ],
           "Resource": [
               "arn:aws:s3:::REPLACEME_BUCKETNAME/*",