aws:policy/CloudWatchAgentServerPolicy is lacking ec2:DescribeTags policy

I am attempting to follow the instructions at https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/ContainerInsights-Prometheus-Setup.html. However the pod for Prometheus does not come up:

```
2023/12/18 01:28:20 Describe EC2 Tag Fail. Will retry the request: UnauthorizedOperation: You are not authorized to perform this operation. User: arn:aws:sts::xxx:assumed-role/yyy-workernodes/i-zzz is not authorized to perform: ec2:DescribeTags because no identity-based policy allows the ec2:DescribeTags action
```

The most likely cause is that the managed policy `arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy` is lacking said permission.

Start with the linked AWS Container Insights Prometheus setup instructions and the reported UnauthorizedOperation message. Inspect the permissions associated with arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy and verify whether ec2:DescribeTags is required for this setup. Done means the required permission gap is confirmed and the Prometheus pod can start without this authorization error.

Written by the indexing model from the issue text.