Cannot create load balancer in AWS about kubicorn HOT 8 OPEN

I'm not using kubicorn but I just ran into this today walking through the Getting Started with Amazon EKS guide. I followed the same exact steps I did last week, where I did not receive this error.

I was able to get around it by attaching a new policy to the role I assigned to my EKS cluster but I wonder what changed?

from kubicorn.

@stevenoctopus Which policy fixed the issue?

from kubicorn.

I created a new policy, which allowed the service role I created for eks to perform iam:CreateServiceLinkedRole on the AWSServiceRoleForElasticLoadBalancing role in my account, and then attached that to the eks service role.

However, I don't think that is correct to do. I found out AWS automatically created the AWSServiceRoleForElasticLoadBalancing role if you created a load balancer before January of this year. (I'm on my phone or I would link the docs where I found this)

Nothing in my account was using the AWSServiceRoleForElasticLoadBalancing role so I wanted to try deleting it and starting the process over. I will try on Monday and report back my results.

from kubicorn.

No luck deleting the role and trying again. I get the same error even when the AWSServiceRoleForElasticLoadBalancing role doesn't exist in my account. Very strange.

There is a post about this in the AWS forums that I am also watching.

from kubicorn.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "iam:CreateServiceLinkedRole",
            "Resource": "arn:aws:iam::015345740490:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"
        }
    ]
}

Here is a policy you can attach to the EKS service role as a workaround for the time being. I subbed in the correct account ID for you already.

from kubicorn.

Thanks for posting the additional context. Is iam:CreateServiceLinkedRole not covered by IAMFullAccess?

from kubicorn.

from kubicorn.

Makes sense - this particular example is for a demo, so I'm less concerned for now & can reduce the scope once it's all working. The service account I created for kubicorn already has IAMFullAccess, so I'm not sure I understand how to apply this workaround.

from kubicorn.