aws / aws/aws-cdk

(aws_eks): Using the default cluster role triggers a cluster health issue

Open
#32,222 7 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-eks @aws-cdk/aws-eks-v2-alpha bug p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the bug

Creating a new cluster with no user created role passed triggers a health event with the following message.
```
Hello,

Amazon EKS detected cluster health issues in your AWS account 1234567890.

The following is a list of affected clusters with their cluster arns, cluster health status and corresponding cluster health issues(s):
arn:aws:eks:us-east-1:1234567890:cluster/my-cluster : IMPAIRED : Your cluster is not using the Amazon EKS service-linked-role. We couldnt assume the role associated with your cluster to perform required Amazon EKS management operations. Check the role exists and has the required trust policy.
```

It seems like the role still works for normal operations, but the new observability checks do not play nicely with it.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

Default role does not trigger the health event

### Current Behavior

See Above

### Reproduction Steps

Create a cluster
```
new eks.Cluster(this, 'hello-eks', {
version: eks.KubernetesVersion.V1_31,
kubectlLayer: new KubectlV31Layer(this, 'kubectl'),
});
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.168.0

### Framework Version

_No response_

### Node.js Version

18.20.4

### OS

Mac

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the eks.Cluster reproduction using KubernetesVersion.V1_31 and KubectlV31Layer, then inspect how the default cluster role and its trust policy are configured. Compare the deployed role with Amazon EKS's service-linked-role requirements and verify that creating a cluster without a user-supplied role no longer produces the reported health event.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, typescript
Domain
cloud, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.