chore(eks): support EKS service link role

[pahud]

Commit Message

core(eks): support EKS service link role

Prior to April 16, 2020, AmazonEKSServicePolicy was required for EKS cluster IAM role. With the new AWSServiceRoleForAmazonEKS service-linked role, that policy is no longer required.

This PR removes the AmazonEKSServicePolicy from the cluster role.

Closes #7634

End Commit Message

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[mergify]

Title does not follow the guidelines of Conventional Commits. Please adjust title before merge.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 673ef87
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[eladb]

@pahud this seems like it's mainly about removing AmazonEKSServicePolicy. Should we scope the PR down to this change first?

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 01607b6
• Result: FAILED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 329299e
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[eladb]

@pahud Can you include some details in the commit message about how this change resolves the issue?

[pahud]

@pahud Can you include some details in the commit message about how this change resolves the issue?

OK. Done.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 6ff144f
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: d58fa1d
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[stefanolczak]

After this change it's impossible to update EKS clusters ( from AWS console or CDK ) deployed before 16th of April because the update requires the AmazonEKSServicePolicy in cluster IAM role. AWS returns an error:

Role with arn: arn:aws:iam::XXXXX:role/staging-eks-cluster-StagingEksClusterRole7CDF300A-1D3OQMFWTZVW8, could not be assumed because it does not exist or the trusted entity is not correct

To make it work the policy has to be added manually to the IAM role or the cluster has to be deployed from scratch. Unfortunately it causes a drift in cloudformation templates generated by CDK.