diff --git a/CHANGELOG.md b/CHANGELOG.md
index a6acc9c..893a3c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -75,3 +75,6 @@
 
 * 3.0.0 -- 2023-11-22 tf-upgrade
   - if pgp_key_file is not provided (empty), it will use the secret vs encrypted secret, so that the secret can be used as input into other resources
+
+* 3.0.1 -- 2024-07-17
+  - add permissions_boundary attribute
diff --git a/README.md b/README.md
index 4cd6901..4c1eaa0 100644
--- a/README.md
+++ b/README.md
@@ -138,6 +138,7 @@ No requirements.
 | <a name="input_iam_username"></a> [iam\_username](#input\_iam\_username) | AWS username for user (default a-username) | `string` | `""` | no |
 | <a name="input_inline_policies"></a> [inline\_policies](#input\_inline\_policies) | List of IAM Policy Document objects to include in this user. Format is {name=name,policy=policy-json} | `list(object({ name = string, policy = string }))` | `[]` | no |
 | <a name="input_path"></a> [path](#input\_path) | IAM path | `string` | `"/"` | no |
+| <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | ARN of permission boundary policy | `string` | `null` | no |
 | <a name="input_pgp_key"></a> [pgp\_key](#input\_pgp\_key) | PGP key used to encrypt access key | `string` | `""` | no |
 | <a name="input_pgp_key_file"></a> [pgp\_key\_file](#input\_pgp\_key\_file) | PGP key filename for encrypting the access key (supercedes pgp\_key) | `string` | `""` | no |
 | <a name="input_profile"></a> [profile](#input\_profile) | AWS Profile Name, used generating key rotation file | `string` | `null` | no |
diff --git a/main.tf b/main.tf
index 1a5ea6f..d94aa81 100644
--- a/main.tf
+++ b/main.tf
@@ -130,9 +130,10 @@ locals {
 # user setup
 #---
 resource "aws_iam_user" "user" {
-  name          = local.iam_username
-  path          = var.path
-  force_destroy = true
+  name                 = local.iam_username
+  path                 = var.path
+  force_destroy        = true
+  permissions_boundary = var.permissions_boundary
 
   tags = local.tags
 }
diff --git a/variables.tf b/variables.tf
index 10274f2..e337a89 100644
--- a/variables.tf
+++ b/variables.tf
@@ -112,3 +112,9 @@ variable "component_tags" {
   type        = map(map(string))
   default     = { "user" = {}, "policy" = {} }
 }
+
+variable "permissions_boundary" {
+  description = "ARN of permission boundary policy"
+  type        = string
+  default     = null
+}
diff --git a/version.tf b/version.tf
index 964202d..3f9d9cb 100644
--- a/version.tf
+++ b/version.tf
@@ -1,4 +1,4 @@
 locals {
   _module_name    = "aws-iam-user"
-  _module_version = "3.0.0"
+  _module_version = "3.0.1"
 }