diff --git a/terraform/hcp_iam.tf b/terraform/hcp_iam.tf
index 2d7624c..d165f89 100644
--- a/terraform/hcp_iam.tf
+++ b/terraform/hcp_iam.tf
@@ -368,6 +368,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
       "ec2:DetachInternetGateway",
       "ec2:DisassociateAddress",
       "ec2:DisassociateRouteTable",
+      "ec2:ModifySecurityGroupRules",
       "ec2:ModifySubnetAttribute",
       "ec2:ModifyVpcAttribute",
       "ec2:ReleaseAddress",