fix: add missing IAM permission for NLB with EIPs

[danvbloomberg]

PR o'clock

Description

For services that make use of NLB instead of ELB (annotated with service.beta.kubernetes.io/aws-load-balancer-type=nlb), if EIPs are specified (annotated with service.beta.kubernetes.io/aws-load-balancer-eip-allocations=<eips>), then an additional permission is required, 'ec2:DescribeAddresses', in order for the NLB to be created beyond what was already added in this PR (#902).

This is what the error looks like in the logs:

failed to ensure load balancer: error creating load balancer: "AccessDenied: User: arn:aws:sts::xxxxxxx:assumed-role/xxxxxxxx/xxxxxxxx is not authorized to perform: ec2:DescribeAddresses\n\tstatus code: 403, request id: xxxxxxxx"

This is what the relevant service annotations look like that reproduces this issue:

...
        service.beta.kubernetes.io/aws-load-balancer-type: "nlb"
        service.beta.kubernetes.io/aws-load-balancer-eip-allocations: "${join(",", aws_eip.nlb.*.id)}"
...

Checklist

• CI tests are passing
• README.md has been updated after any changes to variables and outputs. See https://github.com/terraform-aws-modules/terraform-aws-eks/#doc-generation

[limed]

+1 to this PR as well as I have ran into this exact problem

[daroga0002]

🚀 LGTM

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.