iam:PassRole not working with provided CFN template in AWS China

[artem-nefedov]

Description

Observed Behavior:

When deploying to AWS China using CloudFormation template advised in official docs, NodeClaims get stuck in unknown status and User <role> is not authorized to perform: iam:PassRole on resource... error is seen in the status message.

Manually editing policy and changing "iam:PassedToService": "ec2.amazonaws.com" to "iam:PassedToService": "ec2.amazonaws.com.cn" fixes the problem, and NodeClaims work fine after that.

However, if I fix this in the CFN (see #6839) and try to create everything from scratch, it instead fails with the same error when reconciling EC2NodeClass, which now gets stuck in unknown status instead of NodeClaim.

Versions:

• Chart Version: 1.0.0
• Kubernetes Version (kubectl version): EKS 1.30

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

[artem-nefedov]

The problem goes away if condition in iam:PassRole is completely removed.
It's not elegant, but it works.