fix(eks): allow describe provisioning lamba to ec2:DescribeVpcs

[dnascimento]

The EKS provision lambda requires ec2:DescribeVpcs so that it can configure the EKS cluster in an existing VPC

Signed-off-by: Dario Nascimento dfrnascimento@gmail.com

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[gitpod-io]

[mergify]

Title does not follow the guidelines of Conventional Commits. Please adjust title before merge.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 28fda46
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[iliapolo]

The thing is that this already exists here:

aws-cdk/packages/@aws-cdk/aws-eks/lib/cluster-resource.ts

Lines 179 to 186 in fe6ec39

	creationRole.addToPolicy(new iam.PolicyStatement({
	actions: ['ec2:DescribeVpcs'],
	resources: [stack.formatArn({
	service: 'ec2',
	resource: 'vpc',
	resourceName: props.vpc.vpcId,
	})],
	}));

However, this only grants it for the specific VPC its going to use. Why do we need permissions to describe ALL VPC's?

Also, did you add this because you hit the error described here? Im not sure this explains the sporadic behavior.

[github-actions]

This PR has not received a response in a while. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[rfs6]

Hello Guys,

I had the same situation when I tried do launch a EKS cluster during my first attempt, on the second it worked.

I added the permission ec2:Describe* and it worked on the first time, however I don't know if it is too permissive(leat privilege).

Is there somebody from CDK team who can take a look at this?

Thanks in advanced.

[eladb]

How are we doing with this PR?

[iliapolo]

I don't believe this error is caused by the fix proposed in this PR. See #9027 (comment).

@dnascimento I'm closing this at the moment, please let me know if you still feel differently.