(aws_eks): Using the default cluster role triggers a cluster health issue
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the bug
Creating a new cluster with no user created role passed triggers a health event with the following message.
```
Hello,
Amazon EKS detected cluster health issues in your AWS account 1234567890.
The following is a list of affected clusters with their cluster arns, cluster health status and corresponding cluster health issues(s):
arn:aws:eks:us-east-1:1234567890:cluster/my-cluster : IMPAIRED : Your cluster is not using the Amazon EKS service-linked-role. We couldnt assume the role associated with your cluster to perform required Amazon EKS management operations. Check the role exists and has the required trust policy.
```
It seems like the role still works for normal operations, but the new observability checks do not play nicely with it.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Version
_No response_
### Expected Behavior
Default role does not trigger the health event
### Current Behavior
See Above
### Reproduction Steps
Create a cluster
```
new eks.Cluster(this, 'hello-eks', {
version: eks.KubernetesVersion.V1_31,
kubectlLayer: new KubectlV31Layer(this, 'kubectl'),
});
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.168.0
### Framework Version
_No response_
### Node.js Version
18.20.4
### OS
Mac
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start with the eks.Cluster reproduction using KubernetesVersion.V1_31 and KubectlV31Layer, then inspect how the default cluster role and its trust policy are configured. Compare the deployed role with Amazon EKS's service-linked-role requirements and verify that creating a cluster without a user-supplied role no longer produces the reported health event.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes, typescript
- Domain
- cloud, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100