diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0fb7bfc..e0223a2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ project adheres to [Semantic Versioning](http://semver.org/).
 - Test against minimum versions specified in `versions.tf` (by @dpiddockcmp)
 - Support for AWS EKS Managed Node Groups. (by @wmorgan6796)
 - Updated instance_profile_names and instance_profile_arns outputs to also consider launch template as well as asg (by @ankitwal)
+- Added a if check on `aws-auth` configmap when map_roles is empty. 
 - **Breaking:** Configure the aws-auth configmap using the terraform kubernetes providers. Read the [docs](docs/upgrading-to-aws-auth-kubernetes-provider.md) for more info (by @sdehaes)
 - Updated application of `aws-auth` configmap to create `kube_config.yaml` and `aws_auth_configmap.yaml` in sequence (and not parallel) to `kubectl apply` (by @knittingdev)
 - Exit with error code when `aws-auth` configmap is unable to be updated (by @knittingdev)
diff --git a/aws_auth.tf b/aws_auth.tf
index 9e9d48f..916661d 100644
--- a/aws_auth.tf
+++ b/aws_auth.tf
@@ -53,7 +53,7 @@ resource "kubernetes_config_map" "aws_auth" {
   data = {
     mapRoles    = <<EOF
 ${join("", distinct(concat(data.template_file.launch_template_worker_role_arns.*.rendered, data.template_file.worker_role_arns.*.rendered)))}
-%{if var.map_roles != []}${yamlencode(var.map_roles)}%{endif}
+%{if var.map_roles == []}${yamlencode(var.map_roles)}%{endif}
     EOF
     mapUsers    = yamlencode(var.map_users)
     mapAccounts = yamlencode(var.map_accounts)