diff --git a/aws_auth.tf b/aws_auth.tf
index e2aac0e0fc..db6dea4708 100644
--- a/aws_auth.tf
+++ b/aws_auth.tf
@@ -48,13 +48,13 @@ locals {
     {
       rolearn  = role["worker_role_arn"]
       username = "system:node:{{EC2PrivateDNSName}}"
-      groups = concat(
+      groups = tolist(concat(
         [
           "system:bootstrappers",
           "system:nodes",
         ],
         role["platform"] == "windows" ? ["eks:kube-proxy-windows"] : []
-      )
+      ))
     }
   ]
 }