diff --git a/modules/iam-role-for-service-accounts-eks/policies.tf b/modules/iam-role-for-service-accounts-eks/policies.tf
index a134c3f9..1b8c0db2 100644
--- a/modules/iam-role-for-service-accounts-eks/policies.tf
+++ b/modules/iam-role-for-service-accounts-eks/policies.tf
@@ -947,9 +947,9 @@ data "aws_iam_policy_document" "appmesh_controller" {
 
   statement {
     actions = [
-      "arn:${local.partition}:iam::*:role/aws-service-role/appmesh.${local.dns_suffix}/AWSServiceRoleForAppMesh"
+      "iam:CreateServiceLinkedRole"
     ]
-    resources = ["*"]
+    resources = ["arn:${local.partition}:iam::*:role/aws-service-role/appmesh.${local.dns_suffix}/AWSServiceRoleForAppMesh"]
     condition {
       test     = "StringLike"
       variable = "iam:AWSServiceName"