diff --git a/.github/workflows/terraform-apply.yaml b/.github/workflows/terraform-apply.yaml
index 44c73f8..a7e9180 100644
--- a/.github/workflows/terraform-apply.yaml
+++ b/.github/workflows/terraform-apply.yaml
@@ -4,6 +4,11 @@ on:
   push:
     branches:
       - master
+    paths:
+      - 'terraform/**'
+      - .github/workflows/terraform-apply.yaml
+
+permissions: write-all
 
 jobs:
   plan-and-approve: