diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 22ab97059..69e3ae233 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -449,6 +449,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: [windows-step-3, linux]
     if: always()
+    permissions:
+      contents: read
     steps:
       - name: Download aws-cli
         if: ${{ inputs.create_release && inputs.update_branch == 'release' }}