create EKS cluster & resources with IAM Role Provider

[beetahnator]

Addresses issue: #140

[metral]

A couple of nitpicks, but overall LGTM.

This is a great PR, thank you!

I'll test this across the full test suite.

[metral]

Given that this PR is introducing a aws.Provider for the cluster, and it waits to assume the role, I wonder if this will temper down the IAM related issues we're seeing around role creation & assuming roles in CI: #203 & #204.

Thoughts @lukehoban ?

[beetahnator]

Thanks for the feedback @metral and @lukehoban

If nothing else comes up, I'll push an update this week to address the remaining concerns.

• Make the Role & Provider optional
• Add documentation for the Role Policy permissions

[beetahnator]

I found this issue on one of AWS's repos: aws/containers-roadmap#378

If anyone with more sway could chime in to get the [system:masters] role defined explicitly that would awesome.

For the time being I refactored the PR to be backwards compatible and added a getRoleProvider and CreationRoleProvider in case someone wanted to manually generate it.

Example usage:

  const creationRoleProvider = eks.getRoleProvider("test");

  const cluster = new eks.Cluster("test", {
    creationRoleProvider: creationRoleProvider,
    subnetIds: [...privateSubnets.ids, ...publicSubnets.ids],
    nodeSubnetIds: privateSubnets.ids,
    vpcId: vpc.id
  });

[metral]

LGTM. Couple of nitpicks - @lukehoban thoughts?

[metral]

Recent changes LGTM. @lukehoban PTAL

Could we also squash down to a single commit?