Unathorized operation terraform(aws) in gitlab runner

I'm using aws sts assume-role-with-web-identity to run terraform from gitlab. I'm getting an error I can't find the missing IAM action for:

╷
│ Error: Error fetching Availability Zones: UnauthorizedOperation: You are not authorized to perform this operation.
│   status code: 403, request id: 43a2032d-1bdd-4957-add9-070d3c270343
│ 
│   with module.vpc.data.aws_availability_zones.available,
│   on modules/terraform-aws-vpc/private.tf line 1, in data "aws_availability_zones" "available":
│    1: data "aws_availability_zones" "available" {

data source:

data "aws_availability_zones" "available" {
  state = "available"
}

I've tried multiple variations of ec2 actions, even: "ec2:*" but the issue remains.

Solutions found online usually recommend admin privileges, but I'm hoping for a better solution

Iam policy:

  statement {
    actions = [
      "ec2:CreateVpc",
      "ec2:CreateSubnet",
      "ec2:DescribeAvailabilityZones",
      "ec2:CreateRouteTable",
      "ec2:CreateRoute",
      "ec2:CreateInternetGateway",
      "ec2:AttachInternetGateway",
      "ec2:AssociateRouteTable",
      "ec2:ModifyVpcAttribute",
      "ec2:DescribeAvailabilityZones"
    ]
    effect = "Allow"
    resources = [
      "arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*",
      "arn:aws:ec2::${data.aws_caller_identity.current.account_id}:ipam-pool/*",
      "arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:ipv6pool-ec2/*",
      "arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:subnet/*",
      "arn:aws:ec2:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:vpc/*"
    ]
  }

replacing resources with: "*" so this is causing the issue