fsx with eks rights error

pvc shows

kdpvc fsx-claim                                                                          ✔  admin@rdqa-k8s.us-east-2.eksctl.io/kube-system ⎈  10:24:30 AM 
Name:          fsx-claim
Namespace:     kube-system
StorageClass:  fsx-sc-ssd
Status:        Pending
Volume:
Labels:        <none>
Annotations:   volume.beta.kubernetes.io/storage-provisioner: fsx.csi.aws.com
Finalizers:    [kubernetes.io/pvc-protection]
Capacity:
Access Modes:
VolumeMode:    Filesystem
Used By:       <none>
Events:
  Type     Reason              Age   From                                                                                               Message
  ----     ------              ----  ----                                                                                               -------
  Warning  ProvisioningFailed  15s   fsx.csi.aws.com_ip-192-168-49-104.us-east-2.compute.internal_bdda4953-e9b1-4e1f-bd89-42b1e73c731f  failed to provision volume with StorageClass "fsx-sc-ssd": rpc error: code = Internal desc = Could not create volume "pvc-60824d3c-f1c1-4c78-bea0-ff9c8387fd7a": CreateFileSystem failed: AccessDeniedException: User: arn:aws:sts::xxxxxxxxxxx:assumed-role/AmazonEKSFSxLustreCSIDriverRDQA/1653963866481056780 is not authorized to perform: fsx:CreateFileSystem on resource: arn:aws:fsx:us-east-2:802625923695:file-system/* because no identity-based policy allows the fsx:CreateFileSystem action
           status code: 400, request id: d9829a30-d680-4d1a-9638-74368de38e63
  Normal   ExternalProvisioning  13s (x2 over 15s)  persistentvolume-controller                                                                        waiting for a volume to be created, either by external provisioner "fsx.csi.aws.com" or manually created by system administrator