fix(eks): missing required permission for fargate profile

Creating fargate profile without specifying `subnetSelection` will require extra iam policy to allow the iam role to describe subnets and route tables to select private subnets. This PR adds the required `ec2:DescribeRouteTables` for the cluster creation role. Closes aws#7614
luisantonioa · May 3, 2020 · 723813f · 723813f
1 parent fbb8ff3
commit 723813f
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 4 deletions.
diff --git a/packages/@aws-cdk/aws-eks/lib/cluster-resource.ts b/packages/@aws-cdk/aws-eks/lib/cluster-resource.ts
@@ -73,7 +73,10 @@ export class ClusterResource extends Construct {
     });
 
     this.creationRole.addToPolicy(new iam.PolicyStatement({
-      actions: [ 'ec2:DescribeSubnets' ],
+      actions: [
+        'ec2:DescribeSubnets',
+        'ec2:DescribeRouteTables',
+      ],
       resources: [ '*' ],
     }));
 

diff --git a/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.expected.json b/packages/@aws-cdk/aws-eks/test/integ.eks-cluster.expected.json
@@ -782,7 +782,10 @@
               }
             },
             {
-              "Action": "ec2:DescribeSubnets",
+              "Action": [
+                "ec2:DescribeSubnets",
+                "ec2:DescribeRouteTables"
+              ],
               "Effect": "Allow",
               "Resource": "*"
             },

diff --git a/packages/@aws-cdk/aws-eks/test/test.cluster.ts b/packages/@aws-cdk/aws-eks/test/test.cluster.ts
@@ -866,7 +866,10 @@ export = {
               },
             },
             {
-              Action: 'ec2:DescribeSubnets',
+              Action: [
+                'ec2:DescribeSubnets',
+                'ec2:DescribeRouteTables',
+              ],
               Effect: 'Allow',
               Resource: '*',
             },
@@ -977,7 +980,10 @@ export = {
               },
             },
             {
-              Action: 'ec2:DescribeSubnets',
+              Action: [
+                'ec2:DescribeSubnets',
+                'ec2:DescribeRouteTables',
+              ],
               Effect: 'Allow',
               Resource: '*',
             },