diff --git a/ecr.tf b/ecr.tf
index 2141b04..ef959cf 100644
--- a/ecr.tf
+++ b/ecr.tf
@@ -38,14 +38,15 @@
             "Effect": "Allow",
             "Resource": "*",
             "Action": [
-                "ecr:GetDownloadUrlForLayer",
                 "ecr:BatchGetImage",
                 "ecr:BatchCheckLayerAvailability",
+                "ecr:CompleteLayerUpload",
                 "ecr:GetAuthorizationToken",
-                "ecr:PutImage",
+                "ecr:GetDownloadUrlForLayer",
                 "ecr:InitiateLayerUpload",
-                "ecr:UploadLayerPart",
-                "ecr:CompleteLayerUpload"
+                "ecr:ListImages",
+                "ecr:PutImage",
+                "ecr:UploadLayerPart"
             ]
         }
     ]
diff --git a/infra.tf b/infra.tf
index b142def..da19792 100644
--- a/infra.tf
+++ b/infra.tf
@@ -37,7 +37,7 @@
 
 #servers
 resource "aws_instance" "staging-ci" {
-    ami           = "ami-0286372f78291e588"
+    ami           = "ami-0ac80df6eff0e70b5"
     instance_type = "t3.large"
     # hardcoding for the time being.  In the future we may want
     # to split staging off to its own subnet.