diff --git a/policies/sc-dbuser/policy.tf b/policies/sc-dbuser/policy.tf
index e073441..0f09dc0 100644
--- a/policies/sc-dbuser/policy.tf
+++ b/policies/sc-dbuser/policy.tf
@@ -89,7 +89,7 @@ data "aws_iam_policy_document" "inline" {
       test     = "StringEquals"
       variable = "secretsmanager:ResourceTag/jbid"
       values = [
-        "&{aws:PrincipalTag/jbid}"
+        "$${aws:PrincipalTag/jbid}"
       ]
     }
     # Name tag pattern includes the caller identifier.
@@ -97,7 +97,7 @@ data "aws_iam_policy_document" "inline" {
       test     = "StringLike"
       variable = "secretsmanager:ResourceTag/Name"
       values = [
-        "*&{aws:PrincipalTag/jbid}*"
+        "*$${aws:PrincipalTag/jbid}*"
       ]
     }
   }