diff --git a/doc/user/layouts/partials/create-source/connector/s3/with-options.html b/doc/user/layouts/partials/create-source/connector/s3/with-options.html
index 65ae68b2cd54e..50800a977564e 100644
--- a/doc/user/layouts/partials/create-source/connector/s3/with-options.html
+++ b/doc/user/layouts/partials/create-source/connector/s3/with-options.html
@@ -21,7 +21,7 @@
 | Key Name Source       | Permissions Required                                                                     |
 |-----------------------|------------------------------------------------------------------------------------------|
 | All                   | [`GetObject` permission][getobject] for the objects that they will download              |
-| **BUCKET SCAN**       | [`ListObject` permission][listobject] for the buckets it will scan                       |
+| **BUCKET SCAN**       | [`ListObject` permission][listobject] for the buckets it will scan, **unless** the `MATCHING` pattern can only match a single object. In such cases, Materialize will perform only the necessary `GetObject` API call. |
 | **SQS NOTIFICATIONS** | `GetMessage`, `GetQueueUrl` [SQS Permissions][sqs-perms] for the queue it will listen to |
 
 The root AWS documentation for S3 permissions is [available here][s3-permissions].