diff --git a/README.md b/README.md
index 6373f71..ea54471 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,7 @@ No modules.
 | [aws_iam_role.opencode_mcp](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
 | [aws_iam_role_policy.bedrock_batch_invoke](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.bedrock_batch_s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
+| [aws_iam_role_policy.github_actions_channel_project_site_acm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_channel_project_site_deploy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_channel_project_site_infrastructure](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
 | [aws_iam_role_policy.github_actions_channel_project_site_log_delivery](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
diff --git a/aws-channel-project-site-acm.tf b/aws-channel-project-site-acm.tf
new file mode 100644
index 0000000..70463a9
--- /dev/null
+++ b/aws-channel-project-site-acm.tf
@@ -0,0 +1,31 @@
+# This scoped role policy is separate from S3/CloudFront distribution management.
+# It grants only the ACM lifecycle actions required by channel-project's
+# us-east-1 CloudFront viewer certificate.
+resource "aws_iam_role_policy" "github_actions_channel_project_site_acm" {
+  name = "channel-project-site-acm"
+  role = aws_iam_role.github_actions_channel_project_site_infrastructure.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid      = "RequestSiteViewerCertificate"
+        Effect   = "Allow"
+        Action   = ["acm:RequestCertificate"]
+        Resource = "*"
+      },
+      {
+        Sid    = "ManageSiteViewerCertificate"
+        Effect = "Allow"
+        Action = [
+          "acm:AddTagsToCertificate",
+          "acm:DeleteCertificate",
+          "acm:DescribeCertificate",
+          "acm:ListTagsForCertificate",
+          "acm:RemoveTagsFromCertificate"
+        ]
+        Resource = "arn:aws:acm:us-east-1:${data.aws_caller_identity.current.account_id}:certificate/*"
+      }
+    ]
+  })
+}