feat: Add IAM permissions for ELB svc-linked role creation by EKS cluster #902
Conversation
ivan-sukhomlyn
force-pushed
the
improvement_permissions_for_ELB_service_linked_role_creation
branch
2 times, most recently
from
713c9c1
to
27c9e45
Compare
cluster.tf
Outdated
|
|
||
| statement { | ||
| effect = "Allow" | ||
| actions = ["ec2:DescribeAccountAttributes"] |
There was a problem hiding this comment.
Hi!
Ran into this same issue, and ended up needing ec2:DescribeInternetGateways in addition to the above IAM access action.
Thanks for the fix. 🙇
There was a problem hiding this comment.
Hi James,
Thank you for the suggestion regarding ec2:DescribeInternetGateways permissions that must be attached to the IAM role as well.
ivan-sukhomlyn
force-pushed
the
improvement_permissions_for_ELB_service_linked_role_creation
branch
from
27c9e45
to
8317af9
Compare
AmazonEKSClusterPolicy IAM policy doesn't contain all necessary permissions to create ELB service-linked role required during LB provisioning at AWS by K8S Service. terraform-aws-modules#900 terraform-aws-modules#183 (comment)
ivan-sukhomlyn
force-pushed
the
improvement_permissions_for_ELB_service_linked_role_creation
branch
from
8317af9
to
f2842da
Compare
|
We also encounter the same issue, would be cool if this can be merged |
barryib
changed the title
|
@dpiddockcmp can you please review this. |
There was a problem hiding this comment.
Multiple people confirmed the issue exists and that this is the fix.
Looking through CloudTrail this change at least makes first creation of LBs a lot faster, as kubernetes only needs to attempt it once. Before the change it took 3 attempts in a sample account which had the service account deleted.
ivan-sukhomlyn
deleted the
improvement_permissions_for_ELB_service_linked_role_creation
branch
|
@barryib @dpiddockcmp Thank you guys |
…ster (terraform-aws-modules#902) AmazonEKSClusterPolicy IAM policy doesn't contain all necessary permissions to create ELB service-linked role required during LB provisioning at AWS by K8S Service. terraform-aws-modules#900 terraform-aws-modules#183 (comment)
|
I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further. |
PR o'clock
Description
AmazonEKSClusterPolicy IAM policy doesn't contain all necessary permissions to create ELB service-linked role required during LB provisioning at AWS by K8S Service.
#900
Checklist