diff --git a/infrastructure/stacks/iams-developer-roles/github_actions_policies.tf b/infrastructure/stacks/iams-developer-roles/github_actions_policies.tf
index 13cdaf7f..13664e1b 100644
--- a/infrastructure/stacks/iams-developer-roles/github_actions_policies.tf
+++ b/infrastructure/stacks/iams-developer-roles/github_actions_policies.tf
@@ -678,49 +678,6 @@ resource "aws_iam_policy" "iam_management" {
   tags = merge(local.tags, { Name = "iam-management" })
 }
 
-# Assume role policy document for GitHub Actions
-data "aws_iam_policy_document" "github_actions_assume_role" {
-  statement {
-    sid     = "OidcAssumeRoleWithWebIdentity"
-    effect  = "Allow"
-    actions = ["sts:AssumeRoleWithWebIdentity"]
-
-    principals {
-      type = "Federated"
-      identifiers = [
-        aws_iam_openid_connect_provider.github.arn
-      ]
-    }
-
-    condition {
-      test     = "StringLike"
-      variable = "token.actions.githubusercontent.com:sub"
-      values   = ["repo:${var.github_org}/${var.github_repo}:*"]
-    }
-
-    condition {
-      test     = "StringEquals"
-      variable = "token.actions.githubusercontent.com:aud"
-      values   = ["sts.amazonaws.com"]
-    }
-  }
-  dynamic "statement" {
-    for_each = var.environment == "dev" ? [1] : []
-    content {
-      sid    = "AllowDevSSORoleToAssumeIamBootstrap"
-      effect = "Allow"
-      actions = ["sts:AssumeRole"]
-
-      principals {
-        type = "AWS"
-        identifiers = [
-          local.dev_role_arn
-        ]
-      }
-    }
-  }
-}
-
 resource "aws_iam_policy" "stream_management" {
   name        = "stream-management"
   description = "Allow GitHub Actions to manage project Firehose delivery streams and Kinesis streams"
@@ -845,6 +802,190 @@ resource "aws_iam_policy" "cloudwatch_management" {
   tags = merge(local.tags, { Name = "cloudwatch-management" })
 }
 
+data "aws_iam_policy_document" "regression_test_permissions" {
+  statement {
+    sid    = "S3Access"
+    effect = "Allow"
+    actions = [
+      "s3:ListBucket",
+      "s3:GetObject",
+      "s3:PutObject",
+      "s3:DeleteObject",
+      "s3:GetBucketTagging",
+      "s3:GetObjectTagging",
+      "s3:PutObjectTagging",
+      "s3:GetObjectVersion"
+    ],
+    resources = [
+      "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules",
+      "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules/*",
+      "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map",
+      "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map/*"
+    ]
+  }
+
+  statement {
+    sid    = "DynamoAccess"
+    effect = "Allow"
+    actions = [
+      "dynamodb:GetItem",
+      "dynamodb:PutItem",
+      "dynamodb:Query",
+      "dynamodb:Scan",
+      "dynamodb:UpdateItem",
+      "dynamodb:DeleteItem",
+      "dynamodb:DescribeTable",
+      "dynamodb:ListTables",
+      "dynamodb:DeleteTable",
+      "dynamodb:CreateTable",
+      "dynamodb:TagResource",
+      "dynamodb:UntagResource",
+      "dynamodb:ListTagsOfResource"
+    ]
+    resources = [
+      "arn:aws:dynamodb:*:${data.aws_caller_identity.current.account_id}:table/*eligibility-signposting-api-${var.environment}-eligibility_datastore"
+    ]
+  }
+
+  statement {
+    sid = "SecretsManagerAccess"
+    effect = "Allow"
+    actions = [
+      "secretsmanager:GetSecretValue",
+      "secretsmanager:PutSecretValue",
+      "secretsmanager:DescribeSecret",
+      "secretsmanager:UpdateSecretVersionStage"
+      ]
+    resources = ["*"]
+  }
+
+  statement {
+    sid    = "CloudWatchLogsRead"
+    effect = "Allow"
+    actions = [
+      "logs:DescribeLogGroups",
+      "logs:DescribeLogStreams",
+      "logs:GetLogEvents",
+      "logs:FilterLogEvents",
+      "logs:StartQuery",
+      "logs:GetQueryResults",
+      "logs:StopQuery"
+    ]
+    resources = ["*"]
+  }
+
+  statement {
+    sid    = "XRayRead"
+    effect = "Allow"
+    actions = [
+      "xray:GetTraceSummaries",
+      "xray:BatchGetTraces",
+      "xray:GetServiceGraph",
+      "xray:GetGroups",
+      "xray:GetGroup",
+      "xray:GetSamplingRules",
+      "xray:GetSamplingTargets",
+      "xray:GetSamplingStatisticSummaries",
+      "xray:UpdateSamplingRule"
+    ]
+    resources = ["*"]
+  }
+
+  statement {
+    sid    = "SSMRead"
+    effect = "Allow"
+    actions = [
+      "ssm:GetParameter",
+      "ssm:GetParameters",
+      "ssm:GetParametersByPath"
+    ]
+    resources = [
+      "arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}/*",
+      "arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/splunk/*",
+      "arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/ptl/*",
+      "arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/prod/*"
+    ]
+  }
+}
+
+resource "aws_iam_policy" "regression_test_permissions" {
+  name        = "regression-test-permissions"
+  description = "Permissions for the regression test GitHub Actions role"
+  path        = "/service-policies/"
+  policy      = data.aws_iam_policy_document.regression_test_permissions.json
+}
+
+# Assume role policy document for GitHub Actions
+data "aws_iam_policy_document" "github_actions_assume_role" {
+  statement {
+    sid     = "OidcAssumeRoleWithWebIdentity"
+    effect  = "Allow"
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+
+    principals {
+      type = "Federated"
+      identifiers = [
+        aws_iam_openid_connect_provider.github.arn
+      ]
+    }
+
+    condition {
+      test     = "StringLike"
+      variable = "token.actions.githubusercontent.com:sub"
+      values   = ["repo:${var.github_org}/${var.github_repo}:*"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "token.actions.githubusercontent.com:aud"
+      values   = ["sts.amazonaws.com"]
+    }
+  }
+  dynamic "statement" {
+    for_each = var.environment == "dev" ? [1] : []
+    content {
+      sid    = "AllowDevSSORoleToAssumeIamBootstrap"
+      effect = "Allow"
+      actions = ["sts:AssumeRole"]
+
+      principals {
+        type = "AWS"
+        identifiers = [
+          local.dev_role_arn
+        ]
+      }
+    }
+  }
+}
+
+# Assume role policy document for GitHub Actions
+data "aws_iam_policy_document" "regression_repo_assume_role" {
+  statement {
+    sid    = "OidcAssumeRoleWithWebIdentity"
+    effect = "Allow"
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+
+    principals {
+      type = "Federated"
+      identifiers = [
+        aws_iam_openid_connect_provider.github.arn
+      ]
+    }
+
+    condition {
+      test     = "StringLike"
+      variable = "token.actions.githubusercontent.com:sub"
+      values = ["repo:${var.github_org}/${var.regression_repo}:*"]
+    }
+
+    condition {
+      test     = "StringEquals"
+      variable = "token.actions.githubusercontent.com:aud"
+      values = ["sts.amazonaws.com"]
+    }
+  }
+}
+
 # Attach the policies to the role
 resource "aws_iam_role_policy_attachment" "api_infrastructure" {
   role       = aws_iam_role.github_actions.name
@@ -885,3 +1026,13 @@ resource "aws_iam_role_policy_attachment" "cloudwatch_management" {
   role       = aws_iam_role.github_actions.name
   policy_arn = aws_iam_policy.cloudwatch_management.arn
 }
+
+resource "aws_iam_role_policy_attachment" "regression_test_permissions" {
+  role       = aws_iam_role.regression_test_role.name
+  policy_arn = aws_iam_policy.regression_test_permissions.arn
+}
+
+resource "aws_iam_role_policy_attachment" "regression_security_management" {
+  role       = aws_iam_role.regression_test_role.name
+  policy_arn = aws_iam_policy.security_management.arn
+}
diff --git a/infrastructure/stacks/iams-developer-roles/github_actions_role.tf b/infrastructure/stacks/iams-developer-roles/github_actions_role.tf
index 29a4a53a..ce54e624 100644
--- a/infrastructure/stacks/iams-developer-roles/github_actions_role.tf
+++ b/infrastructure/stacks/iams-developer-roles/github_actions_role.tf
@@ -107,3 +107,20 @@ data "aws_iam_policy_document" "github_actions_iam_bootstrap_assume_role" {
     }
   }
 }
+
+resource "aws_iam_role" "regression_test_role" {
+  name                 = "Eligibility-API-E2E-Regression-Tests"
+  description          = "Role for regression testing"
+  permissions_boundary = aws_iam_policy.permissions_boundary.arn
+  path                 = "/service-roles/"
+
+  # Trust policy allowing GitHub Actions to assume the role
+  assume_role_policy = data.aws_iam_policy_document.regression_repo_assume_role.json
+
+  tags = merge(
+    local.tags,
+    {
+      Name = "Eligibility-API-E2E-Regression-Tests"
+    }
+  )
+}
diff --git a/infrastructure/stacks/iams-developer-roles/variables.tf b/infrastructure/stacks/iams-developer-roles/variables.tf
index 8de5b51b..020a815e 100644
--- a/infrastructure/stacks/iams-developer-roles/variables.tf
+++ b/infrastructure/stacks/iams-developer-roles/variables.tf
@@ -9,3 +9,9 @@ variable "github_repo" {
   description = "GitHub repository"
   type        = string
 }
+
+variable "regression_repo" {
+  default     = "eligibility-signposting-api-regression-tests"
+  description = "GitHub repository"
+  type        = string
+}