diff --git a/aws/policy/security-services.yaml b/aws/policy/security-services.yaml
index 2da0751..d926273 100644
--- a/aws/policy/security-services.yaml
+++ b/aws/policy/security-services.yaml
@@ -65,8 +65,8 @@ Statement:
       - access-analyzer:ValidatePolicy
       - iam:GetRole
       - iam:List*
-      - iam:TagRole
-      - iam:UntagRole
+      - iam:Tag*
+      - iam:Untag*
       - kms:CreateAlias
       - kms:CreateGrant
       - kms:DeleteAlias