diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56be768..b1de01d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -501,3 +501,7 @@
 * 2.14.0 -- 2026-05-08
   - routing
     - update to associate nat-gateway on public subnet if boc:vpc:attach-nat-gateway=true
+
+* 2.15.0 -- 2026-07-16
+  - route53-zone-association/terraform-role
+    - add DescribeVpcEndpoint*
diff --git a/common/version.tf b/common/version.tf
index 0b3bb2c..b8b0ca5 100644
--- a/common/version.tf
+++ b/common/version.tf
@@ -1,5 +1,5 @@
 locals {
-  _module_version = "2.14.0"
+  _module_version = "2.15.0"
   _module_names = {
     "_main_" = "aws-vpc-setup"
 
diff --git a/route53-zone-association/terraform-role/main.tf b/route53-zone-association/terraform-role/main.tf
index 3f0e718..a9c65dc 100644
--- a/route53-zone-association/terraform-role/main.tf
+++ b/route53-zone-association/terraform-role/main.tf
@@ -68,6 +68,7 @@ data "aws_iam_policy_document" "policy" {
     actions = [
       "iam:ListAccountAliases",
       "ec2:DescribeVpcs",
+      "ec2:DescribeVpcEndpoint*",
       "ec2:DescribeAvailabilityZones",
       "route53:Get*",
       "route53:List*",