diff --git a/dist/base-setup.yml b/dist/base-setup.yml
index a3415f8c..a091cb3e 100644
--- a/dist/base-setup.yml
+++ b/dist/base-setup.yml
@@ -282,6 +282,10 @@ Resources:
             - "logs:DeleteLogGroup"
             - "logs:DeleteSubscriptionFilter"
             - "ecs:DeregisterTaskDefinition"
+            - "lambda:DeleteFunction"
+            - "lambda:InvokeFunction"
+            - "events:RemoveTargets"
+            - "lambda:RemovePermission"
             Resource: "*"
 
 ### cloud watch to kinesis role