diff --git a/docs/features/techdocs/using-cloud-storage.md b/docs/features/techdocs/using-cloud-storage.md
index d5a3a68425..23015935da 100644
--- a/docs/features/techdocs/using-cloud-storage.md
+++ b/docs/features/techdocs/using-cloud-storage.md
@@ -135,7 +135,21 @@ techdocs:
       bucketName: 'name-of-techdocs-storage-bucket'
 ```
 
-**3a. (Recommended) Setup authentication the AWS way, using environment
+**3. Create minimal AWS IAM policies to manage TechDocs**
+
+To _write_ TechDocs into the S3 bucket the IAM policy needs to have at a minimum
+permissions to:
+
+- `s3:ListBucket` to retrieve bucket metadata
+- `s3:PutObject` to upload files to the bucket
+
+To _read_ TechDocs from the S3 bucket the IAM policy needs to have at a minimum
+permissions to:
+
+- `s3:ListBucket` - To retrieve bucket metadata
+- `s3:GetObject` - To retrieve files from the bucket
+
+**4a. (Recommended) Setup authentication the AWS way, using environment
 variables**
 
 You should follow the
@@ -166,7 +180,7 @@ more in
 The AWS Region of the bucket is optional since TechDocs uses AWS SDK V2 and not
 V3.
 
-**3b. Authentication using app-config.yaml**
+**4b. Authentication using app-config.yaml**
 
 AWS credentials and region can be provided to the AWS SDK via `app-config.yaml`.
 If the configs below are present, they will be used over existing `AWS_*`
@@ -187,7 +201,7 @@ techdocs:
 Refer to the
 [official AWS documentation for obtaining the credentials](https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/getting-your-credentials.html).
 
-**3c. Authentication using an assumed role** Users with multiple AWS accounts
+**4c. Authentication using an assumed role** Users with multiple AWS accounts
 may want to use a role for S3 storage that is in a different AWS account. Using
 the `roleArn` parameter as seen below, you can instruct the TechDocs publisher
 to assume a role before accessing S3.
@@ -207,7 +221,7 @@ Note: Assuming a role requires that primary credentials are already configured
 at `AWS.config.credentials`. Read more about
 [assuming roles in AWS](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html).
 
-**4. That's it!**
+**5. That's it!**
 
 Your Backstage app is now ready to use AWS S3 for TechDocs, to store and read
 the static generated documentation files. When you start the backend of the app,