From 1b1f9f48d2e2a7dd2c4c83afee5341771d0308e1 Mon Sep 17 00:00:00 2001
From: yutachaos <18604471+yutachaos@users.noreply.github.com>
Date: Sun, 24 Apr 2022 23:47:43 +0900
Subject: [PATCH] Fixed policy for app mesh controller

---
 modules/iam-role-for-service-accounts-eks/policies.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/iam-role-for-service-accounts-eks/policies.tf b/modules/iam-role-for-service-accounts-eks/policies.tf
index a134c3f9..1b8c0db2 100644
--- a/modules/iam-role-for-service-accounts-eks/policies.tf
+++ b/modules/iam-role-for-service-accounts-eks/policies.tf
@@ -947,9 +947,9 @@ data "aws_iam_policy_document" "appmesh_controller" {
 
   statement {
     actions = [
-      "arn:${local.partition}:iam::*:role/aws-service-role/appmesh.${local.dns_suffix}/AWSServiceRoleForAppMesh"
+      "iam:CreateServiceLinkedRole"
     ]
-    resources = ["*"]
+    resources = ["arn:${local.partition}:iam::*:role/aws-service-role/appmesh.${local.dns_suffix}/AWSServiceRoleForAppMesh"]
     condition {
       test     = "StringLike"
       variable = "iam:AWSServiceName"