diff --git a/lib/actions-runner-hcptf-stack.ts b/lib/actions-runner-hcptf-stack.ts
index 7e82760..072d253 100644
--- a/lib/actions-runner-hcptf-stack.ts
+++ b/lib/actions-runner-hcptf-stack.ts
@@ -393,6 +393,16 @@ function iamPolicyDocument(): object {
         ],
         Resource: `arn:aws:iam::${ACCOUNT}:oidc-provider/*`,
       },
+      {
+        Sid: "ReadEksServiceRoles",
+        Effect: "Allow",
+        Action: "iam:GetRole",
+        Resource: [
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-fargate-pods.amazonaws.com/*`,
+          `arn:aws:iam::${ACCOUNT}:role/aws-service-role/eks-nodegroup.amazonaws.com/*`,
+        ],
+      },
       {
         Sid: "ServiceLinkedRoles",
         Effect: "Allow",