diff --git a/src/crucible/aws/iam.clj b/src/crucible/aws/iam.clj
index 3988d7c..667abae 100644
--- a/src/crucible/aws/iam.clj
+++ b/src/crucible/aws/iam.clj
@@ -36,7 +36,7 @@
 (s/def ::not-principal ::principal)
 
 (s/def ::action-element (spec-or-ref (s/and string?
-                                            #(re-matches #"[a-zA-Z0-9*:]+" %))))
+                                            #(re-matches #"[a-zA-Z0-9*:_\-]+" %))))
 
 (s/def ::action (s/or :single ::action-element
                       :list (s/+ ::action-element)))
diff --git a/test/crucible/aws/iam_test.clj b/test/crucible/aws/iam_test.clj
index fffae3f..46edb13 100644
--- a/test/crucible/aws/iam_test.clj
+++ b/test/crucible/aws/iam_test.clj
@@ -36,6 +36,8 @@
 
 (deftest action-tests
 
+  (testing "hyphen in action" (is (valid ::iam/action "execute-api:Invoke")))
+
   (testing "all actions" (is (valid ::iam/action "*")))
 
   (testing "single action" (is (valid ::iam/action "s3:PutObject")))