[EKS] [Cluster BUG]: if KMS key policy doesn't allow EKS role: "Role (...) does not exist or the trusted entity is not correct"

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Which service(s) is this request for?**
EKS

**Tell us about your issue**
Updating a cluster that uses KMS for encryption, if the KMS key has a policy that doesn't explicitly give access from the cluster role, returns:
```
An error occurred (InvalidRequestException) when calling the UpdateClusterVersion operation: Role with arn: arn:aws:iam::xxxxxx:role/xxxxxxxx, could not be assumed because it does not exist or the trusted entity is not correct
```
This extract is from `aws-cli`, I also tried `eksctl`, the web gui, `terraform`, all with the same result.

Note that using secrets inside kubernetes works fine (how ?).
Also note that AWS documentation doesn't contains anything about this.
It seems like people online aren't bumping into this problem because they aren't using the KMS key policy feature ?

**Work around:**
Adding this to the key policy:
```
{
"Sid": "KeyAdminEKS",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::xxx:role/xxx"
},
"Action": "kms:*",
"Resource": "*"
}
```
TODO: refine the allowed actions
It's 11pm, I bumped into this issue at 12am, so much for easy upgrade, thanks AWS/EKS 😡.

**What's needed:**
- a piece of documentation somewhere about the minimum policy needed for the KMS key
- a better error message when updating the cluster

Start by reproducing the EKS cluster update through aws-cli, eksctl, the web GUI, or terraform with a KMS key policy that omits the cluster role. Review the documented KMS policy requirements and the reported role-assumption error. Done means documenting the minimum required policy and improving the error message, if the relevant service behavior is confirmed.

Written by the indexing model from the issue text.