diff --git a/cmd/infra/aws/delegatingclientgenerator/main.go b/cmd/infra/aws/delegatingclientgenerator/main.go
index 457728cc8f4c..8438df6d3537 100644
--- a/cmd/infra/aws/delegatingclientgenerator/main.go
+++ b/cmd/infra/aws/delegatingclientgenerator/main.go
@@ -392,6 +392,7 @@ var extendedAPIs = map[string][]string{
 		"CreateQueue",
 		"DeleteQueue",
 		"SendMessage",
+		"TagQueue",
 	},
 	"route53": {
 		"AssociateVPCWithHostedZone",
diff --git a/cmd/infra/aws/iam.go b/cmd/infra/aws/iam.go
index 73928e74a65c..627efe8ac323 100644
--- a/cmd/infra/aws/iam.go
+++ b/cmd/infra/aws/iam.go
@@ -506,15 +506,27 @@ var (
         "ec2:DescribeLaunchTemplates",
         "ec2:DescribeLaunchTemplateVersions",
         "ec2:DeleteLaunchTemplate",
-        "ec2:DeleteLaunchTemplateVersions",
-		"sqs:DeleteMessage",
-        "sqs:ReceiveMessage"
+        "ec2:DeleteLaunchTemplateVersions"
       ],
       "Resource": [
         "*"
       ],
       "Effect": "Allow"
     },
+    {
+      "Sid": "NodePoolSQSActions",
+      "Effect": "Allow",
+      "Action": [
+        "sqs:DeleteMessage",
+        "sqs:ReceiveMessage"
+      ],
+      "Resource": "*",
+      "Condition": {
+        "StringEquals": {
+          "aws:ResourceTag/red-hat": "true"
+        }
+      }
+    },
     {
       "Condition": {
         "StringLike": {
diff --git a/support/awsapi/sqs.go b/support/awsapi/sqs.go
index ea9ca6039dcc..03fb8ae32857 100644
--- a/support/awsapi/sqs.go
+++ b/support/awsapi/sqs.go
@@ -23,6 +23,7 @@ type SQSAPI interface {
 	DeleteQueue(ctx context.Context, input *sqs.DeleteQueueInput, optFns ...func(*sqs.Options)) (*sqs.DeleteQueueOutput, error)
 	ReceiveMessage(ctx context.Context, input *sqs.ReceiveMessageInput, optFns ...func(*sqs.Options)) (*sqs.ReceiveMessageOutput, error)
 	SendMessage(ctx context.Context, input *sqs.SendMessageInput, optFns ...func(*sqs.Options)) (*sqs.SendMessageOutput, error)
+	TagQueue(ctx context.Context, input *sqs.TagQueueInput, optFns ...func(*sqs.Options)) (*sqs.TagQueueOutput, error)
 }
 
 // Ensure *sqs.Client implements SQSAPI
diff --git a/test/e2e/nodepool_spot_termination_handler_test.go b/test/e2e/nodepool_spot_termination_handler_test.go
index 2ade4368de71..fb1472b31e0b 100644
--- a/test/e2e/nodepool_spot_termination_handler_test.go
+++ b/test/e2e/nodepool_spot_termination_handler_test.go
@@ -119,7 +119,12 @@ func (s *SpotTerminationHandlerTest) Run(t *testing.T, nodePool hyperv1.NodePool
 						"sqs:ReceiveMessage",
 						"sqs:DeleteMessage"
 					],
-					"Resource": "arn:aws:sqs:%s:*:*"
+					"Resource": "arn:aws:sqs:%s:*:*",
+					"Condition": {
+						"StringEquals": {
+							"aws:ResourceTag/red-hat": "true"
+						}
+					}
 				}
 			]
 		}`, s.clusterOpts.AWSPlatform.Region)
@@ -148,6 +153,9 @@ func (s *SpotTerminationHandlerTest) Run(t *testing.T, nodePool hyperv1.NodePool
 		t.Logf("Creating SQS queue %s", sqsQueueName)
 		createQueueResult, err := sqsClient.CreateQueue(s.ctx, &sqs.CreateQueueInput{
 			QueueName: aws.String(sqsQueueName),
+			Tags: map[string]string{
+				"red-hat": "true",
+			},
 		})
 		if err != nil {
 			t.Fatalf("failed to create SQS queue %s: %v", sqsQueueName, err)