diff --git a/patch-aws-auth/main.tf b/patch-aws-auth/main.tf
index 5ad0331..c5e23b7 100644
--- a/patch-aws-auth/main.tf
+++ b/patch-aws-auth/main.tf
@@ -48,13 +48,13 @@ data "kubernetes_config_map" "aws-auth" {
 
 # map users without ARNs to arns
 data "aws_iam_user" "auth_users" {
-  for_each  = toset([for u in local.joined_auth_users : u.aws_username])
+  for_each  = toset([for u in local.joined_auth_users : u.aws_username if u.aws_username != ""])
   user_name = each.key
 }
 
 # map roles without ARNs to arns
 data "aws_iam_role" "auth_roles" {
-  for_each = toset([for r in local.joined_auth_roles : r.aws_rolename])
+  for_each = toset([for r in local.joined_auth_roles : r.aws_rolename if r.aws_rolename != ""])
   name     = each.key
 }