fix: Add missing TagResource permission needed for EFS CSI

[rrrkharse]

What does this PR do?

Adds the efs:TagResource permissions the EFS CSI driver needs to add the required tags to the EFS file system in use.

This is consistent with the example policy provided by in the EFS CSI driver documentation, which can be found here.

Motivation

Our downstream repository consumes EKS Blueprints Add-ons and uses the EFS CSI driver add-on. We noticed that when using EFS volumes our notebook provisioning process gets stuck at volume creation due to Access Denied exceptions. We determined this missing permission to be the root cause.

• Resolves [Testing in Progress] Create and provide EFS CSI driver policy to blueprints addons awslabs/kubeflow-manifests#726, EFS does not work for terraform deployment when using built-in EFS driver install  awslabs/kubeflow-manifests#717

More

• Yes, I have tested the PR using my local account setup (Provide any test evidence report under Additional Notes)
• Yes, I have updated the docs for this feature
• Yes, I ran pre-commit run -a with this PR

For Moderators

• E2E Test successfully complete before merge?

Additional Notes

Testing:

EKS cluster with EFS add-on created successfully:

Apply complete! Resources: 35 added, 0 changed, 0 destroyed.

Outputs:

configure_kubectl = "aws eks --region us-west-2 update-kubeconfig --name tf-efs-vanilla"
eks_cluster_id = "tf-efs-vanilla"
eks_managed_nodegroup_arns = tolist([
  "arn:aws:eks:us-west-2:556017915589:nodegroup/tf-efs-vanilla/managed-ondemand-cpu-20230504193006564400000009/24c3f41f-205f-c913-76d2-408691c439ac",
])
eks_managed_nodegroup_ids = tolist([
  "tf-efs-vanilla:managed-ondemand-cpu-20230504193006564400000009",
])
eks_managed_nodegroup_role_name = tolist([
  "tf-efs-vanilla-managed-ondemand-cpu",
])
eks_managed_nodegroup_status = tolist([
  "ACTIVE",
])
eks_managed_nodegroups = tolist([
  {
    "mg_cpu" = {
      "managed_nodegroup_arn" = [
        "arn:aws:eks:us-west-2:556017915589:nodegroup/tf-efs-vanilla/managed-ondemand-cpu-20230504193006564400000009/24c3f41f-205f-c913-76d2-408691c439ac",
      ]
      "managed_nodegroup_iam_instance_profile_arn" = [
        "arn:aws:iam::556017915589:instance-profile/tf-efs-vanilla-managed-ondemand-cpu",
      ]
      "managed_nodegroup_iam_instance_profile_id" = [
        "tf-efs-vanilla-managed-ondemand-cpu",
      ]
      "managed_nodegroup_iam_role_arn" = [
        "arn:aws:iam::556017915589:role/tf-efs-vanilla-managed-ondemand-cpu",
      ]
      "managed_nodegroup_iam_role_name" = [
        "tf-efs-vanilla-managed-ondemand-cpu",
      ]
      "managed_nodegroup_id" = [
        "tf-efs-vanilla:managed-ondemand-cpu-20230504193006564400000009",
      ]
      "managed_nodegroup_launch_template_arn" = []
      "managed_nodegroup_launch_template_id" = []
      "managed_nodegroup_launch_template_latest_version" = []
      "managed_nodegroup_status" = [
        "ACTIVE",
      ]
    }
  },
])
vpc_cidr = "10.0.0.0/16"
vpc_private_subnet_cidr = tolist([
  "10.0.96.0/19",
  "10.0.128.0/19",
  "10.0.160.0/19",
])
vpc_public_subnet_cidr = tolist([
  "10.0.0.0/19",
  "10.0.32.0/19",
  "10.0.64.0/19",
])

Role and policy created and tagged with the required permissions:

Full policy contents:

{
    "Statement": [
        {
            "Action": "ec2:DescribeAvailabilityZones",
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "AllowDescribeAvailabilityZones"
        },
        {
            "Action": [
                "elasticfilesystem:DescribeMountTargets",
                "elasticfilesystem:DescribeFileSystems",
                "elasticfilesystem:DescribeAccessPoints"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:elasticfilesystem:us-west-2:556017915589:file-system/*",
                "arn:aws:elasticfilesystem:us-west-2:556017915589:access-point/*"
            ],
            "Sid": "AllowDescribeFileSystems"
        },
        {
            "Action": "elasticfilesystem:CreateAccessPoint",
            "Condition": {
                "StringLike": {
                    "aws:RequestTag/efs.csi.aws.com/cluster": "true"
                }
            },
            "Effect": "Allow",
            "Resource": "arn:aws:elasticfilesystem:us-west-2:556017915589:file-system/*",
            "Sid": "AllowCreateAccessPoint"
        },
        {
            "Action": "elasticfilesystem:DeleteAccessPoint",
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/efs.csi.aws.com/cluster": "true"
                }
            },
            "Effect": "Allow",
            "Resource": "arn:aws:elasticfilesystem:us-west-2:556017915589:access-point/*",
            "Sid": "AllowDeleteAccessPoint"
        },
        {
            "Action": "elasticfilesystem:TagResource",
            "Condition": {
                "StringLike": {
                    "aws:ResourceTag/efs.csi.aws.com/cluster": "true"
                }
            },
            "Effect": "Allow",
            "Resource": [
                "arn:aws:elasticfilesystem:us-west-2:556017915589:file-system/*",
                "arn:aws:elasticfilesystem:us-west-2:556017915589:access-point/*"
            ],
            "Sid": "AllowTagResource"
        },
        {
            "Action": [
                "elasticfilesystem:ClientWrite",
                "elasticfilesystem:ClientRootAccess",
                "elasticfilesystem:ClientMount"
            ],
            "Condition": {
                "Bool": {
                    "elasticfilesystem:AccessedViaMountTarget": "true"
                }
            },
            "Effect": "Allow",
            "Resource": "arn:aws:elasticfilesystem:us-west-2:556017915589:file-system/*",
            "Sid": ""
        }
    ],
    "Version": "2012-10-17"
}

[askulkarni2]

LGTM!