diff --git a/check-ecs-exec.sh b/check-ecs-exec.sh
index 2a692a7..ffde9b7 100755
--- a/check-ecs-exec.sh
+++ b/check-ecs-exec.sh
@@ -34,6 +34,7 @@ set -euo pipefail
 ##             "Action": [
 ##                 "iam:GetInstanceProfile",
 ##                 "iam:SimulatePrincipalPolicy",
+##                 "iam:ListRoles",
 ##                 "ec2:DescribeSubnets",
 ##                 "ec2:DescribeVpcEndpoints",
 ##                 "ecs:DescribeClusters",