diff --git a/ecr.tf b/ecr.tf
index a395bd0..0c15ffb 100644
--- a/ecr.tf
+++ b/ecr.tf
@@ -14,9 +14,11 @@
     {
       "Effect": "Allow",
       "Principal": {
-        "AWS": [ "987685672616",
-                 "arn:aws:iam::487149096843:user/vault"
-               ]
+        "AWS": [
+            "987685672616",
+            "arn:aws:iam::487149096843:user/vault"
+        ],
+        "Service": "ec2.amazonaws.com"
       },
       "Action": "sts:AssumeRole"
     }