diff --git a/terraform/modules/dandiset_bucket/main.tf b/terraform/modules/dandiset_bucket/main.tf
index 3a2b2c7..7707db6 100644
--- a/terraform/modules/dandiset_bucket/main.tf
+++ b/terraform/modules/dandiset_bucket/main.tf
@@ -108,7 +108,7 @@ data "aws_iam_policy_document" "dandiset_bucket_owner" {
   }
 
   dynamic "statement" {
-    for_each = var.allow_heroku_put_object ? [1] : []
+    for_each = (var.allow_cross_account_heroku_put_object || var.allow_heroku_put_object) ? [1] : []
     content {
 
       resources = [