diff --git a/CHANGELOG.md b/CHANGELOG.md
index b05ce6e7cc8e..8f530e3ace99 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -487,6 +487,11 @@ Please follow the instructions before upgrading Cumulus
     `producerGranuleId`.
   - Users must ensure that `cumulus-tf` includes `cnm_response_version  = "3.2.0"` or greater.
 
+### Changes
+
+- **CUMULUS-4416**
+  - sqs permissions granted to "\*" instead of "\<account\>/\*"
+
 ### Added
 
 - **CUMULUS-4059**
diff --git a/tf-modules/cumulus/iam.tf b/tf-modules/cumulus/iam.tf
index 3b67cfbdc72c..2675fdc511c7 100644
--- a/tf-modules/cumulus/iam.tf
+++ b/tf-modules/cumulus/iam.tf
@@ -63,7 +63,13 @@ data "aws_iam_policy_document" "lambda_processing_policy" {
       "states:SendTaskFailure",
       "states:SendTaskSuccess",
       "states:StartExecution",
-      "states:StopExecution"
+      "states:StopExecution",
+      "sqs:SendMessage",
+      "sqs:ReceiveMessage",
+      "sqs:ChangeMessageVisibility",
+      "sqs:DeleteMessage",
+      "sqs:GetQueueUrl",
+      "sqs:GetQueueAttributes",
     ]
     resources = ["*"]
   }
@@ -125,18 +131,6 @@ data "aws_iam_policy_document" "lambda_processing_policy" {
 
   }
 
-  statement {
-    actions = [
-      "sqs:SendMessage",
-      "sqs:ReceiveMessage",
-      "sqs:ChangeMessageVisibility",
-      "sqs:DeleteMessage",
-      "sqs:GetQueueUrl",
-      "sqs:GetQueueAttributes",
-    ]
-    resources = ["arn:aws:sqs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"]
-  }
-
   statement {
     actions   = ["kms:Decrypt"]
     resources = [module.archive.provider_kms_key_arn]