diff --git a/enos/ci/service-user-iam/main.tf b/enos/ci/service-user-iam/main.tf
index be31225ff..0341c3e33 100644
--- a/enos/ci/service-user-iam/main.tf
+++ b/enos/ci/service-user-iam/main.tf
@@ -110,6 +110,7 @@ data "aws_iam_policy_document" "enos_policy_document" {
       "ec2:DescribeVpcs",
       "ec2:DetachInternetGateway",
       "ec2:DisassociateRouteTable",
+      "ec2:GetPasswordData",
       "ec2:ImportKeyPair",
       "ec2:ModifyInstanceAttribute",
       "ec2:ModifySubnetAttribute",
@@ -268,71 +269,3 @@ data "aws_iam_policy_document" "aws_nuke_policy_document" {
     resources = ["*"]
   }
 }
-
-resource "aws_iam_policy" "demo_user" {
-  name        = "DemoUser"
-  path        = "/"
-  description = "Used to allow temporary IAM user creation for end-to-end tests"
-  policy      = data.aws_iam_policy_document.demo_user_policy_document.json
-}
-
-data "aws_iam_policy_document" "demo_user_policy_document" {
-  statement {
-    sid = "BoundaryHostPlugin"
-    actions = [
-      "ec2:DescribeInstances*"
-    ]
-
-    resources = ["*"]
-  }
-
-  statement {
-    sid    = "BoundarySessionS3OnlyMyAccount"
-    effect = "Allow"
-    actions = [
-      "s3:DeleteObject",
-      "s3:GetObject",
-      "s3:GetObjectAttributes",
-      "s3:PutObject",
-      "s3:ListBucket",
-    ]
-
-    condition {
-      test     = "StringEquals"
-      variable = "s3:ResourceAccount"
-      values   = [data.aws_caller_identity.current.account_id]
-    }
-
-    resources = ["*"]
-  }
-
-  statement {
-    sid = "IAMAKRotate"
-    actions = [
-      "iam:CreateAccessKey",
-      "iam:DeleteAccessKey",
-      "iam:ListAccessKeys",
-      "iam:UpdateAccessKey"
-    ]
-
-    resources = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/&{aws:username}"]
-  }
-
-  statement {
-    sid       = "ExplicitDeny"
-    effect    = "Deny"
-    resources = ["*"]
-    not_actions = [
-      "ec2:DescribeInstances",
-      "iam:CreateAccessKey",
-      "iam:DeleteAccessKey",
-      "iam:ListAccessKeys",
-      "iam:UpdateAccessKey",
-      "s3:DeleteObject",
-      "s3:GetObject",
-      "s3:GetObjectAttributes",
-      "s3:PutObject",
-      "s3:ListBucket",
-    ]
-  }
-}